{"id":"CVE-2026-111987","kind":"vulnerability","aliases":["CVE-2026-111987"],"related":[],"title":"stable-diffusion-webui: crafted safetensors metadata triggers cross-site scripting","description":"A vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected by this vulnerability is the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Extra-Networks Card Builder. Such manipulation of the argument __metadata__.sshs_model_hash leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"AUTOMATIC1111 stable-diffusion-webui up to 1.10.1 does not sanitize the __metadata__.sshs_model_hash field read from safetensors model files in the Extra-Networks Card Builder. A remote attacker who supplies a crafted model file can run script in the browser of a user who views the page.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-image-generation","ai-tooling","python","self-hosted","stable-diffusion-webui"],"not_affected_if":["no-untrusted-model-files","only-trusted-models"],"how_to_check":"- Check the installed version of stable-diffusion-webui; versions up to `1.10.1` are reported as affected.\n- unknown whether the Extra-Networks Card Builder is reachable on your instance.","fix":"- unknown; the sources say the project has not responded to the report yet. Watch the upstream repository for a patch, and limit who can add model files to the instance until one is released.","status":"open","published_at":"2026-10-18T14:16:54+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T04:30:55+00:00","updated_at":"2026-10-25T04:30:55+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T04:30:55Z","model":"claude-haiku-5-5","output":{"fix":"- unknown; the sources say the project has not responded to the report yet. Watch the upstream repository for a patch, and limit who can add model files to the instance until one is released.","reach":"network","title":"stable-diffusion-webui: crafted safetensors metadata triggers cross-site scripting","impact":"medium","summary":"AUTOMATIC1111 stable-diffusion-webui up to 1.10.1 does not sanitize the __metadata__.sshs_model_hash field read from safetensors model files in the Extra-Networks Card Builder. A remote attacker who supplies a crafted model file can run script in the browser of a user who views the page.","category":"ai-tooling","nicknames":[],"who_cares":["stable-diffusion-webui","self-hosted","python","ai-image-generation"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Script runs in a viewer's browser, exposing their session or actions.","analyst_note":"Confirm whether the Extra-Networks Card Builder is enabled by default and whether authentication is required, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111987 and the upstream repository.","how_to_check":"- Check the installed version of stable-diffusion-webui; versions up to `1.10.1` are reported as affected.\n- unknown whether the Extra-Networks Card Builder is reachable on your instance.","needs_analyst":true,"not_affected_if":["only-trusted-models","no-untrusted-model-files"],"who_is_affected":"Instances of AUTOMATIC1111 stable-diffusion-webui up to 1.10.1 that load untrusted safetensors model files are exposed, since the flaw is in how model metadata is read and shown in the Extra-Networks cards. Teams that only load models they built or vetted themselves face less risk. Whether the web UI is reachable from outside the network is not stated in the sources.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000686,"input_tokens":3394,"output_tokens":694,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111987':15A,18A '-2026':14A,17A '1.10.1':41B,97C 'affect':98C 'ai':20B,24B 'ai-image-gener':19B 'ai-tool':23B 'argument':125C 'attack':65B,136C 'automatic1111':34B,90C 'avail':145C 'browser':77B 'builder':62B,120C 'card':61B,119C 'compon':115C 'craft':5A,69B 'cross':10A,132C 'cross-sit':9A 'cve':13A,16A 'diffus':3A,32B,37B,93C 'earli':157C 'exploit':142C 'extra':59B,117C 'extra-network':58B,116C 'field':50B 'file':55B,71B,111C 'function':104C 'generat':22B 'hash':49B,129C 'host':29B 'identifi':88C 'imag':21B 'inform':153C 'issu':160C 'launch':139C 'lead':130C 'manipul':122C 'metadata':7A,46B,106C,126C 'might':147C 'model':48B,54B,70B,128C 'modules/sd_models.py':112C 'network':60B,118C 'page':84B 'problem':156C 'project':151C 'public':144C 'python':26B 'read':51B,105C 'remot':64B,140C 'report':161C 'respond':165C 'run':73B 'safetensor':6A,53B,108C 'sanit':44B 'script':12A,74B,134C 'self':28B 'self-host':27B 'site':11A,133C 'sshs':47B,127C 'stabl':2A,31B,36B,92C 'stable-diffusion-webui':1A,30B,35B,91C 'suppli':67B 'tool':25B 'trigger':8A 'use':149C 'user':80B 'view':82B 'vulner':86C,101C 'webui':4A,33B,38B,94C 'yet':166C","nicknames":[],"mitigations":[],"who_affected":"Instances of AUTOMATIC1111 stable-diffusion-webui up to 1.10.1 that load untrusted safetensors model files are exposed, since the flaw is in how model metadata is read and shown in the Extra-Networks cards. Teams that only load models they built or vetted themselves face less risk. Whether the web UI is reachable from outside the network is not stated in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T14:16:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111987","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111987","severity":null,"published_at":"2026-10-18T14:16:54+00:00","modified_at":"2026-10-19T17:17:06+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}