CVE-2025-31114 in Fooocus
Summary
by MITRE • 08/11/2026
Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI may be able to execute arbitrary code on the instance. As of time of publication, no known patched versions are available, but a suggested fix pull request is available.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The Fooocus image generation software presents a critical remote code execution vulnerability in versions 2.5.5 and earlier, stemming from unsafe handling of metadata JSON processing within its web user interface. This flaw resides in the application's improper use of the eval function, which creates an avenue for malicious actors to inject and execute arbitrary code on affected systems. The vulnerability specifically manifests when the web UI processes metadata contained within JSON structures, allowing attackers to exploit this weakness through crafted inputs that leverage the dangerous eval implementation.
This security flaw fundamentally undermines the software's defensive boundaries by enabling attackers with mere access to the Fooocus web interface to escalate their privileges and execute system-level commands. The use of eval in this context represents a classic security anti-pattern that directly maps to CWE-94, which catalogs weaknesses related to the execution of arbitrary code. The vulnerability demonstrates how insufficient input validation and sanitization can create persistent attack vectors, particularly when processing untrusted data through potentially dangerous execution mechanisms.
The operational impact of this vulnerability extends beyond simple code execution to encompass complete system compromise, as attackers can leverage the remote execution capability to install backdoors, exfiltrate sensitive data, or establish persistent access to the affected instances. This risk is particularly severe in environments where Fooocus web UIs are exposed to untrusted networks or users, as it allows for unauthorized system manipulation without requiring additional authentication mechanisms. The lack of available patched versions at the time of publication creates an urgent security concern for organizations relying on these vulnerable software versions.
Security practitioners should implement immediate mitigations including restricting access to Fooocus web interfaces through network segmentation and authentication controls, disabling unnecessary metadata processing capabilities, and monitoring for suspicious activity patterns that might indicate exploitation attempts. The suggested fix in the available pull request addresses the core issue by replacing unsafe eval usage with proper JSON parsing mechanisms, aligning with ATT&CK technique T1059.007 for command and scripting interpreter usage while avoiding the dangerous execution pathways. Organizations should prioritize upgrading to patched versions or implementing compensating controls until official releases address this vulnerability through proper code review and secure implementation practices.