CVE-2026-111984

MEDIUM 4.3

AUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scripting

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function create_item_html of the file modules/ui_extra_networks.py of the component Card Builder. The manipulation of the argument filename leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-79 CWE-94
Vendor	automatic1111
Product	stable-diffusion-webui
Published	Oct 18, 2026

Stay Ahead of the Next One

Get instant alerts for automatic1111 stable-diffusion-webui

Be the first to know when new medium vulnerabilities affecting automatic1111 stable-diffusion-webui are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

AUTOMATIC1111 / stable-diffusion-webui

1.10.0 1.10.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/421650 vuldb.com: https://vuldb.com/vuln/421650/cti vuldb.com: https://vuldb.com/cve/CVE-2026-111984 vuldb.com: https://vuldb.com/submit/1005460 github.com: https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17497 github.com: https://github.com/user-attachments/files/32810554/poc.zip github.com: https://github.com/AUTOMATIC1111/stable-diffusion-webui/

Credits

🔍 r1ck99 (VulDB User) VulDB CNA Team