| Title | AUTOMATIC1111 stable-diffusion-webui v1.10.1 Cross Site Scripting |
|---|
| Description | A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui v1.10.1 and classified
as high 8.4. Affected is the extra-networks card builder of the Lora page
(modules/ui_extra_networks.py create_item_html, fed by extensions-builtin/Lora). The
manipulation of the safetensors __metadata__.sshs_model_hash field of a model file leads
to cross-site scripting that is escalated to remote code execution through the product's
own extension installer. It is possible to launch the attack remotely. User interaction
is required: the victim unpacks (or git clones) a model package into models/Lora and
opens the WebUI page; every subsequent action is performed by the injected script.
Technical Details
- Affected file/function: modules/sd_models.py read_metadata_from_safetensors (metadata
copied verbatim); extensions-builtin/Lora/network.py NetworkOnDisk.set_hash (accepts
sshs_model_hash without hex/length/charset validation); extensions-builtin/Lora/
ui_extra_networks_lora.py (hash appended to search_terms); modules/ui_extra_networks.py
create_item_html lines 312-320 (search_term interpolated without html.escape while the
sibling fields sort_keys and description are escaped)
- Vulnerable parameter: __metadata__.sshs_model_hash string inside a .safetensors LoRA
- Attack vector: Network (the payload travels inside a downloadable model package)
- Privileges required: None
- Trigger condition: card HTML is generated by interface.load on page load, so the
injected event handler executes when the victim opens the UI; the same-origin script
then drives the hidden "install extension from URL" controls (modules/ui_extensions.py),
which git-clones the package and executes its install.py (stage 1), presses "Apply and
restart UI", and the restarted process imports the package's scripts/*.py (stage 2)
Impact
- Confidentiality: High (arbitrary code runs twice in the webui process: as an installer
subprocess and as an imported module after a self-triggered restart; process memory,
files and credentials accessible to the user are exposed)
- Integrity: High (attacker code persists across restarts via the installed extension)
- Availability: High (arbitrary code execution in the server process)
CVSS v3.1
Score: 8.4 (High)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
(scored AV:L because the attacker's only channel is a model package the victim downloads
and the WebUI is bound to localhost in the configuration where the chain completes;
scoring the same chain with S:U gives 7.8, still High)
Timeline
- Discovered: 2026-09-20
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]
Countermeasure
Escape search_term with html.escape at modules/ui_extra_networks.py:312-320 (the file
already escapes sort_keys and description the same way), and validate sshs_model_hash in
NetworkOnDisk.set_hash (extensions-builtin/Lora/network.py:50-57) against a hex pattern,
treating a non-matching value as "no recorded hash". |
|---|
| Source | ⚠️ https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17500 |
|---|
| User | r1ck99 (UID 100733) |
|---|
| Submission | 09/30/2026 02:33 (29 days ago) |
|---|
| Moderation | 10/17/2026 23:50 (18 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 421653 [AUTOMATIC1111 stable-diffusion-webui up to 1.10.1 Extra-Networks Card Builder modules/sd_models.py read_metadata_from_safetensors __metadata__.sshs_model_hash cross site scripting] |
|---|
| Points | 20 |
|---|