CVE-2026-111984 | AUTOMATIC1111 stable-diffusion-webui up to 1.10.1 Card Builder ui_extra_networks.py create_item_html filename cross site scripting (Issue 17497)

October 17, 2026 Yanac

A vulnerability marked as problematic has been reported in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function create_item_html of the file modules/ui_extra_networks.py of the component Card Builder. The manipulation of the argument filename leads to cross site scripting.

This vulnerability is traded as CVE-2026-111984. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More