---
id: "CVE-2026-111986"
kind: "vulnerability"
aliases: ["CVE-2026-111986"]
title: "Stable Diffusion WebUI: model loader lets a remote request inject code"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "stable-diffusion-webui", "fixed": [], "affected": ">= 1.10.0, <= 1.10.1 (also master)", "ecosystem": "github"}]
ecosystems: []
tags: ["ai-image-generation", "ai-tooling", "python", "self-hosted", "stable-diffusion-webui", "untrusted-model-files"]
not_affected_if: ["auth-required", "localhost-only-binding", "no-sidecar-yaml", "no-third-party-models"]
published_at: "2026-10-18T13:16:35+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T03:24:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111986", "first_seen_at": "2026-10-23T21:57:15+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:24:57+00:00"}]
---

# Stable Diffusion WebUI: model loader lets a remote request inject code

AUTOMATIC1111 stable-diffusion-webui 1.10.1 (and master) loads a same-name .yaml next to a checkpoint and resolves its model.target to any Python callable, so a downloaded model package can run code when the checkpoint is selected. It is not a direct remote request: the victim must place and select the package. No patch exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:stable-diffusion-webui affected >= 1.10.0, <= 1.10.1 (also master) fixed ?

## How to check

- Run: find models/Stable-diffusion -name '*.yaml' -o -name hubconf.py, and review any YAML sharing a base name with a checkpoint (look at model.target).
- Console line 'Creating model from config:' pointing at a YAML inside a model folder rather than the repo's configs/ is the signature.
- Check git rev-parse HEAD against 82a973c (v1.10.1); no later release exists.

## Fix

unknown: no fixed release or upstream patch as of 2026-10-25; issue #17499 open with no maintainer reply seen. Workaround: delete same-basename .yaml sidecars and hubconf.py from untrusted model packages, restrict write access to models/Stable-diffusion/, run webui as unprivileged user without secrets in env.

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111986
- 2026-10-25T03:24:57+00:00 analyst — Not a request parameter: the Target is the model.target string in a same-basename YAML next to a checkpoint (issue #17499, reporter PoC; CVE record). No fixed release or maintainer response found; 1.10.1 is newest per Severity Daily (secondary), master unchanged. No exploitation reported; PoC public. Nothing marked verified (no vendor words).

## Documents

- [advisory] CVE Record CVE-2026-111986 https://www.cve.org/CVERecord?id=CVE-2026-111986
- [describes] Severity Daily: SD web UI executes Python from YAML beside the model https://severitydaily.com/automatic1111-cve-2026-111986-yaml-sidecar-target-code-execution-6-3-vs-8-8/
- [poc] Issue #17499: code execution via same-basename YAML sidecar (model.target) https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17499

## From the sources

A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_str of the file modules/sd_models.py of the component Model Instantiation. This manipulation of the argument Target causes code injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_