CVE-2026-111987 | AUTOMATIC1111 stable-diffusion-webui up to 1.10.1 Extra-Networks Card Builder modules/sd_models.py read_metadata_from_safetensors __metadata__.sshs_model_hash cross site scripting (Issue 17500)

SecurityVulns
Yanac

A vulnerability classified as problematic was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected by this vulnerability is the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Extra-Networks Card Builder. Such manipulation of the argument __metadata__.sshs_model_hash leads to cross site scripting.

This vulnerability is uniquely identified as CVE-2026-111987. The attack can be launched remotely. Moreover, an exploit is present.

The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More