---
id: "CVE-2026-111984"
kind: "vulnerability"
aliases: ["CVE-2026-111984"]
title: "stable-diffusion-webui: filename handling in Card Builder allows cross-site scripting"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "stable-diffusion-webui", "fixed": [], "affected": "<= 1.10.1", "ecosystem": "github"}]
ecosystems: []
tags: ["ai-tooling", "poc-public", "python", "self-hosted", "stable-diffusion-webui", "xss"]
not_affected_if: ["local-only-use", "no-untrusted-models", "windows-host"]
published_at: "2026-10-18T12:17:11+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:32:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111984", "first_seen_at": "2026-10-23T21:57:14+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T04:32:10+00:00"}]
---

# stable-diffusion-webui: filename handling in Card Builder allows cross-site scripting

In AUTOMATIC1111 stable-diffusion-webui up to 1.10.1, the extra-networks card builder (create_item_html in modules/ui_extra_networks.py) puts a model's filename into HTML without escaping. A file whose name contains a quote and markup runs script in the WebUI origin when the page loads. A PoC is public in the upstream issue. No fix exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:stable-diffusion-webui affected <= 1.10.1 fixed ?

## How to check

- Run git -C stable-diffusion-webui describe --tags; 1.10.1 or older is affected, and no later release exists.
- Look in modules/ui_extra_networks.py: if filename is formatted into the copy-path button (data-clipboard-text) or search_terms span without html.escape, you are exposed.
- List model dirs for names with quotes or angle brackets: find models -name '*"*' -o -name '*<*'

## Fix

No fixed release. 1.10.1 is the latest release and master HEAD, and the project has not responded to issue #17497. Workaround: do not place model or LoRA files with untrusted filenames (quotes, angle brackets) in the models tree. Reporter's suggested patch: wrap item['filename'] (about line 273) and the search_terms values (about lines 312-320) in html.escape.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111984
- 2026-10-25T04:32:10+00:00 analyst — No fix: 1.10.1 is latest release and master HEAD (82a973c); upstream issue #17497 open, unanswered, has PoC. Injection is the unescaped model filename in extra-networks card HTML, fires on page load. Sources: GitHub issue, al-ice.ai, releases; NVD page returned empty.

## Documents

- [advisory] NVD CVE-2026-111984 https://nvd.nist.gov/vuln/detail/CVE-2026-111984
- [mentions] al-ice.ai: Two Stable Diffusion WebUI CVEs (project unresponsive, master = 1.10.1) https://al-ice.ai/posts/2026/10/a1111-cve-2026-111986-111987-model-sidecar-config-code-execution/
- [mentions] stable-diffusion-webui releases (latest 1.10.1) https://github.com/AUTOMATIC1111/stable-diffusion-webui/releases
- [poc] Issue #17497: HTML injection in extra-networks cards via model filename (with PoC) https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17497

## From the sources

A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function create_item_html of the file modules/ui_extra_networks.py of the component Card Builder. The manipulation of the argument filename leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_