CVE-2026-111986 | AUTOMATIC1111 stable-diffusion-webui up to 1.10.1 Model Instantiation modules/sd_models.py get_obj_from_str target code injection (Issue 17499)

October 17, 2026 Yanac

A vulnerability classified as critical has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_str of the file modules/sd_models.py of the component Model Instantiation. This manipulation of the argument Target causes code injection.

This vulnerability is handled as CVE-2026-111986. The attack can be initiated remotely. Additionally, an exploit exists.

The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More