CVE-2026-111984: Cross Site Scripting in AUTOMATIC1111 stable-diffusion-webui

This vulnerability in AUTOMATIC1111 stable-diffusion-webui (versions 1.10.0 and 1.10.1) involves improper sanitization of the filename argument in the create_item_html function of modules/ui_extra_networks.py, leading to cross-site scripting (XSS). An attacker can remotely exploit this flaw to execute arbitrary scripts in the context of the affected web interface. The issue was reported early to the project but remains unaddressed, and public exploit details exist.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the vulnerable web interface, potentially leading to session hijacking, defacement, or other client-side attacks. The CVSS score of 5.3 (medium severity) reflects the network attack vector, low attack complexity, no privileges required, and user interaction needed. There is no indication of further impact such as data breach or system compromise from the provided data.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should exercise caution when handling untrusted filenames in the Card Builder component. Monitor the vendor's advisory channels for updates and apply patches promptly once released. Until then, consider restricting access to the affected functionality or implementing input sanitization as a temporary mitigation.