CVE-2026-111984: AUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scripting
A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function createitemhtml of the file modules/uiextranetworks.py of the component Card Builder. The manipulation of the argument filename leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Instances of AUTOMATIC1111 stable-diffusion-webui up to version 1.10.1 are affected where the Card Builder functionality processes a manipulated filename. The issue can be initiated remotely and does not require attacker privileges, but it does require user interaction.
What does an attacker need to exploit it?
An attacker needs to cause a target user to interact with content that reaches the Card Builder's create_item_html function with a crafted filename. The available data identifies filename manipulation as the XSS injection vector.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
What should teams do if no patch is available?
The provided information does not identify a vendor fix or workaround. Until remediation is available, treat untrusted filenames and content presented through the Card Builder as potentially hostile and limit exposure of the web interface to untrusted users.