CVE-2026-51974: n/a

This vulnerability involves an eval() injection in the get_list function of modules/meta_parser.py in lllyasviel Fooocus versions 2.1.854 through 2.5.5. The flaw allows remote attackers to execute arbitrary Python code by embedding a specially crafted styles payload in the EXIF metadata of an image file uploaded to the application. The vulnerability is identified as CWE-94 (Improper Control of Generation of Code). The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, requiring low privileges and no user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary Python code on the affected system, potentially leading to full system compromise including data theft, system manipulation, or denial of service. The vulnerability affects confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented in the provided data. Until a patch is available, restrict upload functionality to trusted users and validate or sanitize EXIF metadata in uploaded images to prevent malicious payloads.