CVE-2026-111986: AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection
A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function getobjfromstr of the file modules/sdmodels.py of the component Model Instantiation. This manipulation of the argument Target causes code injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attack is initiated remotely by manipulating the Target argument used during model instantiation. The supplied vector indicates user interaction is required, while no attacker privileges are required.
Is exploit activity a practical concern?
A public exploit has been disclosed and may be used. Organizations exposing or allowing remote access to affected stable-diffusion-webui instances should treat the issue as actionable.
What mitigation is available if an update cannot be applied?
The provided information does not identify a fixed version or a vendor-provided workaround. Limit remote access to the application and avoid processing untrusted model-instantiation Target values until a remediation is available.