CVE-2024-12374: Stored XSS in automatic1111/stable-diffusion-webui

Published Mar 20, 2025

Updated

A stored cross-site scripting (XSS) vulnerability exists in automatic1111/stable-diffusion-webui version git 82a973c. An attacker can upload an HTML file, which the application interprets as content-type application/html. If a victim accesses the malicious link, it will execute arbitrary JavaScript in the victim's browser.

Affected Software

2 affected components

automatic1111 stable-diffusion-webui

automatic1111 stable-diffusion-webui=2024-07-27

Event History

Mar 20, 2025

CVE Published

via MITRE·10:08 AM

Data Sourced

via MITRE·10:08 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-12374?

CVE-2024-12374 is classified as a stored cross-site scripting (XSS) vulnerability.

How do I fix CVE-2024-12374?

To fix CVE-2024-12374, update to the latest version of automatic1111/stable-diffusion-webui that addresses this vulnerability.

What versions of software are affected by CVE-2024-12374?

CVE-2024-12374 affects automatic1111/stable-diffusion-webui version git 82a973c.

What type of attack is possible with CVE-2024-12374?

CVE-2024-12374 allows an attacker to execute arbitrary code in the context of the victim's browser through stored XSS.

How can I determine if my system is vulnerable to CVE-2024-12374?

You can determine if your system is vulnerable by checking if you are using automatic1111/stable-diffusion-webui version git 82a973c or earlier.