{"id":"CVE-2026-111986","kind":"vulnerability","aliases":["CVE-2026-111986"],"related":[],"title":"Stable Diffusion WebUI: model loader lets a remote request inject code","description":"A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_str of the file modules/sd_models.py of the component Model Instantiation. This manipulation of the argument Target causes code injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.","summary":"AUTOMATIC1111 stable-diffusion-webui 1.10.1 (and master) loads a same-name .yaml next to a checkpoint and resolves its model.target to any Python callable, so a downloaded model package can run code when the checkpoint is selected. It is not a direct remote request: the victim must place and select the package. No patch exists.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"stable-diffusion-webui","fixed":[],"affected":">= 1.10.0, <= 1.10.1 (also master)","ecosystem":"github"}],"ecosystems":[],"tags":["ai-image-generation","ai-tooling","python","self-hosted","stable-diffusion-webui","untrusted-model-files"],"not_affected_if":["auth-required","localhost-only-binding","no-sidecar-yaml","no-third-party-models"],"how_to_check":"- Run: find models/Stable-diffusion -name '*.yaml' -o -name hubconf.py, and review any YAML sharing a base name with a checkpoint (look at model.target).\n- Console line 'Creating model from config:' pointing at a YAML inside a model folder rather than the repo's configs/ is the signature.\n- Check git rev-parse HEAD against 82a973c (v1.10.1); no later release exists.","fix":"unknown: no fixed release or upstream patch as of 2026-10-25; issue #17499 open with no maintainer reply seen. Workaround: delete same-basename .yaml sidecars and hubconf.py from untrusted model packages, restrict write access to models/Stable-diffusion/, run webui as unprivileged user without secrets in env.","status":"open","published_at":"2026-10-18T13:16:35+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T03:23:32+00:00","updated_at":"2026-10-25T03:24:57+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-25T03:23:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Stable Diffusion WebUI: model loader lets a remote request inject code","impact":"high","summary":"AUTOMATIC1111 stable-diffusion-webui up to 1.10.1 passes an attacker-controlled Target argument into get_obj_from_str in modules/sd_models.py, which causes code injection. A remote attacker who can reach the web interface could run code on the host, and a public exploit has been disclosed.","category":"ai-tooling","nicknames":[],"who_cares":["stable-diffusion-webui","self-hosted","python","ai-image-generation"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Code runs on the server hosting the web interface","analyst_note":"Find whether a fixed release or workaround exists for stable-diffusion-webui past 1.10.1, and confirm which request path reaches the Target argument, using the NVD entry and the project's issue tracker.","how_to_check":"- Check the installed version of stable-diffusion-webui against `1.10.1`; the sources say versions up to 1.10.1 are affected\n- Look at whether `modules/sd_models.py` contains `get_obj_from_str` and how its argument is handled\n- Check whether the web UI is reachable from untrusted networks, for example with `ss -tlnp` or the server's port forwarding","needs_analyst":true,"not_affected_if":["localhost-only-binding","auth-required"],"who_is_affected":"Teams that run AUTOMATIC1111 stable-diffusion-webui, especially with the web interface exposed beyond localhost, are exposed. The sources do not say whether any patched release exists, and the project had not responded to the report at the time. Installations bound to localhost behind authentication are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000659,"input_tokens":3367,"output_tokens":644,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find whether a fixed release or workaround exists for stable-diffusion-webui past 1.10.1, and confirm which request path reaches the Target argument, using the NVD entry and the project's issue tracker.","search":"'-111986':14A,17A '-2026':13A,16A '1.10.1':46B,110C 'affect':111C 'ai':23B,27B 'ai-image-gener':22B 'ai-tool':26B 'argument':132C 'attack':138C 'automatic1111':41B,103C 'callabl':66B 'caus':134C 'checkpoint':58B,77B 'code':11A,74B,135C 'compon':125C 'cve':12A,15A 'determin':101C 'diffus':2A,35B,44B,106C 'diffusion':20A 'direct':84B 'disclos':148C 'download':69B 'earli':160C 'exist':97B 'exploit':144C 'file':40B,121C 'function':114C 'generat':25B 'get':115C 'host':32B 'imag':24B 'inform':156C 'initi':141C 'inject':10A,136C 'instanti':127C 'issu':163C 'let':6A 'load':49B 'loader':5A 'manipul':129C 'master':48B 'may':150C 'model':4A,39B,70B,126C 'model.target':62B 'modules/sd_models.py':122C 'must':89B 'name':53B 'next':55B 'obj':116C 'packag':71B,94B 'patch':96B 'place':90B 'problem':159C 'project':154C 'public':147C 'python':29B,65B 'remot':8A,85B,142C 'report':164C 'request':9A,86B 'resolv':60B 'respond':168C 'run':73B 'same-nam':51B 'select':79B,92B 'self':31B 'self-host':30B 'stabl':1A,34B,43B,105C 'stable':19A 'stable-diffusion-webui':18A,33B,42B,104C 'str':118C 'target':133C 'tool':28B 'untrust':38B 'untrusted-model-fil':37B 'util':152C 'victim':88B 'vulner':99C 'webui':3A,21A,36B,45B,107C 'yaml':54B 'yet':169C","nicknames":[],"mitigations":[],"who_affected":"Anyone running AUTOMATIC1111 stable-diffusion-webui 1.10.0/1.10.1 or current master who downloads model packages (folder or zip) from third-party sources and selects them. Exploitation needs a malicious YAML placed in models/Stable-diffusion/ and the checkpoint selected (user interaction), or write access to that directory or the API option that selects checkpoints. Can skip: installs only using first-party models with no sidecar YAMLs you did not write.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T13:16:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-111986","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111986","severity":null,"published_at":"2026-10-18T13:16:35+00:00","modified_at":"2026-10-22T03:16:32+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111986:709","url":null,"severity":null,"published_at":"2026-10-25T03:24:57+00:00","modified_at":"2026-10-25T03:24:57+00:00","first_seen_at":"2026-10-25T03:24:57+00:00","fetched_at":"2026-10-25T03:24:57+00:00","note":"Not a request parameter: the Target is the model.target string in a same-basename YAML next to a checkpoint (issue #17499, reporter PoC; CVE record). No fixed release or maintainer response found; 1.10.1 is newest per Severity Daily (secondary), master unchanged. No exploitation reported; PoC public. Nothing marked verified (no vendor words)."}],"documents":[{"id":3156,"url":"https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17499","title":"Issue #17499: code execution via same-basename YAML sidecar (model.target)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":3157,"url":"https://severitydaily.com/automatic1111-cve-2026-111986-yaml-sidecar-target-code-execution-6-3-vs-8-8/","title":"Severity Daily: SD web UI executes Python from YAML beside the model","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3158,"url":"https://www.cve.org/CVERecord?id=CVE-2026-111986","title":"CVE Record CVE-2026-111986","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}