Threat database

CVE-2026-111987 is a cross-site scripting (XSS) vulnerability in AUTOMATIC1111 stable-diffusion-webui versions 1.10.0 and 1.10.1. The flaw exists in the read_metadata_from_safetensors function within the Extra-Networks Card Builder component. It allows remote attackers to manipulate the __metadata__.sshs_model_hash argument to execute XSS attacks. Public exploit code is available, but no official vendor response or patch has been issued yet.

CVE-2026-111986 is a code injection vulnerability in AUTOMATIC1111 stable-diffusion-webui versions 1.10.0 and 1.10.1. It affects the get_obj_from_str function in the modules/sd_models.py file, allowing remote attackers to manipulate the Target argument to inject code. The vulnerability has been publicly disclosed, but no patch or vendor response is currently available. The CVSS 4.0 score rates this as a medium severity issue.

CVE-2026-111985 is a medium severity vulnerability in AUTOMATIC1111 stable-diffusion-webui versions 1.10.0 and 1.10.1. It affects the read_metadata_from_safetensors function in the Metadata Extraction component, where manipulation of the header length field argument can lead to resource allocation issues. The vulnerability can be exploited remotely and public exploit code is available. The project has been notified but has not yet responded or issued a fix.

CVE-2026-111984 is a cross-site scripting (XSS) vulnerability in AUTOMATIC1111 stable-diffusion-webui versions 1.10.0 and 1.10.1. The flaw exists in the create_item_html function within the modules/ui_extra_networks.py file, specifically in the Card Builder component. An attacker can remotely manipulate the filename argument to execute malicious scripts. The vulnerability has been publicly disclosed, but no official fix or vendor response has been reported yet.

automatic1111/stable-diffusion-webui version 1.10.0 contains a vulnerability where the server fails to handle excessive characters appended to the end of multipart boundaries. This flaw can be exploited by sending malformed multipart requests with arbitrary characters at the end of the boundary, leading to excessive resource consumption and a complete denial of service (DoS) for all users. The vulnerability is unauthenticated, meaning no user login or interaction is required for an attacker to exploit this issue.