---
id: "CVE-2026-111987"
kind: "vulnerability"
aliases: ["CVE-2026-111987"]
title: "stable-diffusion-webui: crafted safetensors metadata triggers cross-site scripting"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-image-generation", "ai-tooling", "python", "self-hosted", "stable-diffusion-webui"]
not_affected_if: ["no-untrusted-model-files", "only-trusted-models"]
published_at: "2026-10-18T14:16:54+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T04:30:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111987", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# stable-diffusion-webui: crafted safetensors metadata triggers cross-site scripting

AUTOMATIC1111 stable-diffusion-webui up to 1.10.1 does not sanitize the __metadata__.sshs_model_hash field read from safetensors model files in the Extra-Networks Card Builder. A remote attacker who supplies a crafted model file can run script in the browser of a user who views the page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of stable-diffusion-webui; versions up to `1.10.1` are reported as affected.
- unknown whether the Extra-Networks Card Builder is reachable on your instance.

## Fix

- unknown; the sources say the project has not responded to the report yet. Watch the upstream repository for a patch, and limit who can add model files to the instance until one is released.

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111987

## From the sources

A vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected by this vulnerability is the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Extra-Networks Card Builder. Such manipulation of the argument __metadata__.sshs_model_hash leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_