| Title | AUTOMATIC1111 stable-diffusion-webui v1.10.1 Code Injection |
|---|
| Description | A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui v1.10.1 (commit
82a973c04367123ae98bd9abdf80d9eda9b910e2, also current master HEAD) and classified as
high 8.8. Affected is the checkpoint-config discovery / model instantiation component
(modules/sd_models_config.py find_checkpoint_config_near_filename, modules/sd_models.py
load_model / instantiate_from_config / get_obj_from_str). The manipulation of the argument
model.target in a same-basename YAML sidecar of a .safetensors checkpoint leads to code
injection. It is possible to launch the attack remotely: a model package distributed over the
network (model.safetensors + model.yaml + hubconf.py) is unpacked by the victim into
models/Stable-diffusion/, and selecting the checkpoint makes the product load the sidecar YAML
with OmegaConf, resolve model.target via importlib.import_module()+getattr(), and invoke it
with attacker-controlled params. With target torch.hub.load and source=local, torch.hub
imports the package's hubconf.py and executes its top-level code inside the webui process.
User interaction is required because the victim must unpack the package and select the
checkpoint. A negative-control package whose model.yaml only differs in the target string
(torch.nn.Identity instead of torch.hub.load) does not execute the packaged code, confirming
the target field drives the execution.
Technical Details
- Affected file/function: modules/sd_models_config.py:128-136 find_checkpoint_config_near_filename; modules/sd_models.py:809-820 load_model (OmegaConf.load -> instantiate_from_config); modules/sd_models.py:767-783 instantiate_from_config/get_obj_from_str (importlib.import_module + getattr + call); modules/sd_models.py:599-601 repair_config (injects use_ema=False, absorbed by torch.hub.load **kwargs)
- Vulnerable parameter: model.target / model.params in the checkpoint sidecar YAML
- Attack vector: Network (malicious model package downloaded from a model-sharing site)
- Privileges required: None
- Trigger condition: victim unpacks the model package into models/Stable-diffusion/ and selects the checkpoint in the UI (or equivalent API call)
Impact
- Confidentiality: High (arbitrary code execution in the webui process exposes user-reachable data)
- Integrity: High (arbitrary file writes under the victim user)
- Availability: High (arbitrary code can disrupt or terminate the product/host workload)
CVSS v3.1
Score: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Timeline
- Discovered: 2026-09-29
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]
Countermeasure
Restrict checkpoint sidecar configs to a validated schema with an allow-list for model.target
(or only honor explicitly registered configs); do not dynamically import attacker-named
modules from files placed next to downloaded checkpoints. Workaround: do not unpack untrusted
model archives into the models directory and remove any .yaml shipped next to downloaded
checkpoints. |
|---|
| Source | ⚠️ https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17499 |
|---|
| User | r1ck99 (UID 100733) |
|---|
| Submission | 09/30/2026 02:21 (29 days ago) |
|---|
| Moderation | 10/17/2026 23:50 (18 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 421652 [AUTOMATIC1111 stable-diffusion-webui up to 1.10.1 Model Instantiation modules/sd_models.py get_obj_from_str target code injection] |
|---|
| Points | 20 |
|---|