{"id":"CVE-2026-111984","kind":"vulnerability","aliases":["CVE-2026-111984"],"related":[],"title":"stable-diffusion-webui: filename handling in Card Builder allows cross-site scripting","description":"A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function create_item_html of the file modules/ui_extra_networks.py of the component Card Builder. The manipulation of the argument filename leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"In AUTOMATIC1111 stable-diffusion-webui up to 1.10.1, the extra-networks card builder (create_item_html in modules/ui_extra_networks.py) puts a model's filename into HTML without escaping. A file whose name contains a quote and markup runs script in the WebUI origin when the page loads. A PoC is public in the upstream issue. No fix exists.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"stable-diffusion-webui","fixed":[],"affected":"<= 1.10.1","ecosystem":"github"}],"ecosystems":[],"tags":["ai-tooling","poc-public","python","self-hosted","stable-diffusion-webui","xss"],"not_affected_if":["local-only-use","no-untrusted-models","windows-host"],"how_to_check":"- Run git -C stable-diffusion-webui describe --tags; 1.10.1 or older is affected, and no later release exists.\n- Look in modules/ui_extra_networks.py: if filename is formatted into the copy-path button (data-clipboard-text) or search_terms span without html.escape, you are exposed.\n- List model dirs for names with quotes or angle brackets: find models -name '*\"*' -o -name '*<*'","fix":"No fixed release. 1.10.1 is the latest release and master HEAD, and the project has not responded to issue #17497. Workaround: do not place model or LoRA files with untrusted filenames (quotes, angle brackets) in the models tree. Reporter's suggested patch: wrap item['filename'] (about line 273) and the search_terms values (about lines 312-320) in html.escape.","status":"open","published_at":"2026-10-18T12:17:11+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:30:57+00:00","updated_at":"2026-10-25T04:32:10+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-25T04:30:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"stable-diffusion-webui: filename handling in Card Builder allows cross-site scripting","impact":"medium","summary":"The Card Builder component in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1 does not properly handle the filename argument in create_item_html in modules/ui_extra_networks.py. A remote attacker can inject script that runs in a user's browser when the page is rendered.","category":"ai-tooling","nicknames":[],"who_cares":["stable-diffusion-webui","self-hosted","python"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Script runs in a user's browser on the web interface","analyst_note":"Confirm whether a fixed version exists and whether the Card Builder path is reachable by default; check the NVD entry and the upstream issue for patch status.","how_to_check":"- Check the installed version with `git -C stable-diffusion-webui describe --tags` and see whether it is `1.10.1` or older\n- Look at modules/ui_extra_networks.py for the create_item_html function and check whether filename is escaped before it is written into HTML","needs_analyst":true,"not_affected_if":["local-only-use"],"who_is_affected":"Teams that run AUTOMATIC1111 stable-diffusion-webui up to 1.10.1, especially if the interface is reachable from other users or the network. The sources do not say whether a default install exposes the Card Builder path, and they do not name a fixed version. Instances used only locally by a single trusted user carry less risk.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000626,"input_tokens":3371,"output_tokens":578,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Confirm whether a fixed version exists and whether the Card Builder path is reachable by default; check the NVD entry and the upstream issue for patch status.","search":"'-111984':17A,20A '-2026':16A,19A '1.10.1':48B,112C 'affect':114C 'ai':26B 'ai-tool':25B 'allow':10A 'argument':133C 'attack':146C 'automatic1111':41B,105C 'builder':9A,54B,128C 'card':8A,53B,127C 'compon':126C 'contain':73B 'creat':55B,117C 'cross':12A,137C 'cross-sit':11A 'cve':15A,18A 'diffus':3A,37B,44B,108C 'diffusion':23A 'disclos':152C 'earli':167C 'escap':68B 'exist':98B 'exploit':149C 'extra':51B 'extra-network':50B 'file':70B,122C 'filenam':5A,64B,134C 'fix':97B 'found':103C 'function':116C 'handl':6A 'host':34B 'html':57B,66B,119C 'inform':163C 'initi':144C 'issu':95B,170C 'item':56B,118C 'lead':135C 'load':87B 'manipul':130C 'markup':77B 'may':157C 'model':62B 'modules/ui_extra_networks.py':59B,123C 'name':72B 'network':52B 'origin':83B 'page':86B 'poc':29B,89B 'poc-publ':28B 'possibl':142C 'problem':166C 'project':161C 'public':30B,91B,155C 'put':60B 'python':31B 'quot':75B 'remot':147C 'report':171C 'respond':175C 'run':78B 'script':14A,79B,139C 'self':33B 'self-host':32B 'site':13A,138C 'stabl':2A,36B,43B,107C 'stable':22A 'stable-diffusion-webui':1A,21A,35B,42B,106C 'tool':27B 'upstream':94B 'use':159C 'vulner':100C 'webui':4A,24A,38B,45B,82B,109C 'whose':71B 'without':67B 'xss':39B 'yet':176C","nicknames":[],"mitigations":[],"who_affected":"Teams that run AUTOMATIC1111 stable-diffusion-webui up to 1.10.1, especially if the interface is reachable from other users or the network. The sources do not say whether a default install exposes the Card Builder path, and they do not name a fixed version. Instances used only locally by a single trusted user carry less risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T12:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-111984","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111984","severity":null,"published_at":"2026-10-18T12:17:11+00:00","modified_at":"2026-10-19T17:17:06+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111984:815","url":null,"severity":null,"published_at":"2026-10-25T04:32:10+00:00","modified_at":"2026-10-25T04:32:10+00:00","first_seen_at":"2026-10-25T04:32:10+00:00","fetched_at":"2026-10-25T04:32:10+00:00","note":"No fix: 1.10.1 is latest release and master HEAD (82a973c); upstream issue #17497 open, unanswered, has PoC. Injection is the unescaped model filename in extra-networks card HTML, fires on page load. Sources: GitHub issue, al-ice.ai, releases; NVD page returned empty."}],"documents":[{"id":3397,"url":"https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17497","title":"Issue #17497: HTML injection in extra-networks cards via model filename (with PoC)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":3399,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111984","title":"NVD CVE-2026-111984","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3401,"url":"https://al-ice.ai/posts/2026/10/a1111-cve-2026-111986-111987-model-sidecar-config-code-execution/","title":"al-ice.ai: Two Stable Diffusion WebUI CVEs (project unresponsive, master = 1.10.1)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":3398,"url":"https://github.com/AUTOMATIC1111/stable-diffusion-webui/releases","title":"stable-diffusion-webui releases (latest 1.10.1)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}