Submit #1005460: AUTOMATIC1111 stable-diffusion-webui 1.10.1 (commit 82a973c04367123ae98bd9abdf80d9eda9b910e2) Cross Site Scripting

A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui 1.10.1 and classified as medium 4.6. Affected is the extra-networks card builder in the ui_extra_networks component. The manipulation of the argument filename leads to cross site scripting. The attack requires a crafted model package and user interaction: the victim unpacks a shared model file (LoRA) whose filename carries HTML markup and then opens the local WebUI page.

Technical Details
- Affected file/function: modules/ui_extra_networks.py / create_item_html()
- Vulnerable parameter: the on-disk filename of a model file (also reflected a second time through the search_terms interpolation at lines 312-320)
- Attack vector: the filename is interpolated into the card HTML template data-clipboard-text="{filename}" (html/extra-networks-copy-path-button.html, filled at modules/ui_extra_networks.py:273) via str.format with no html.escape; sibling fields sort_keys (:306) and description (:328) are escaped, the filename is not
- Trigger condition: the finished card block is parsed with innerHTML by javascript/extraNetworks.js, so an injected onerror handler executes with the WebUI origin as soon as the page loads; no click on the panel is required
- Constraints: on Linux/macOS a path component may contain any byte except "/" and NUL; Windows forbids quote characters in filenames. A path component is limited to 255 bytes, which bounds the inline payload

Impact
- Confidentiality: Low (page-origin script can read the UI state and drive same-origin endpoints)
- Integrity: Low (page-origin requests are accepted as the local user; a body-less POST /sdapi/v1/refresh-checkpoints was accepted with HTTP 200 in the documented reproduction)
- Availability: None

CVSS v3.1
Score: 4.6 (Medium)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
(On deployments started with --listen or another LAN binding, AV:N applies and the score rises to 5.6.)

Timeline
- Discovered: 2026-09-20
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]

Countermeasure
Escape the filename at both interpolation points in modules/ui_extra_networks.py with the html.escape already used for sibling fields, or deliver the card path as JSON and attach it with setAttribute from JavaScript; escape every metadata-derived field when the item dict is built.

• Source: ⚠️ https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17497
• User: r1ck99 (UID 100733)
• Submission: 09/29/2026 17:51 (29 days ago)
• Moderation: 10/17/2026 23:49 (18 days later)
• Status: Accepted
• VulDB entry: 421650 [AUTOMATIC1111 stable-diffusion-webui up to 1.10.1 Card Builder ui_extra_networks.py create_item_html filename cross site scripting]
• Points: 20