CVE-2026-51974: Lllyasviel Fooocus vulnerability

Q: Which deployments should be investigated for exposure?

lllyasviel Fooocus versions 2.1.854 through 2.5.5 are identified as affected.

Q: What input is required to trigger the issue?

An attacker needs to upload an image whose EXIF metadata contains a crafted styles payload. The payload reaches the get_list function in modules/meta_parser.py and can execute arbitrary Python code.

Published Sep 1, 2026

Updated

An eval() injection vulnerability in the getlist function in modules/metaparser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file.

Affected Software

1 affected component

lllyasviel Fooocus>=2.1.854<=2.5.5

Event History

Sep 1, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Which deployments should be investigated for exposure?

lllyasviel Fooocus versions 2.1.854 through 2.5.5 are identified as affected.

What input is required to trigger the issue?

An attacker needs to upload an image whose EXIF metadata contains a crafted styles payload. The payload reaches the get_list function in modules/meta_parser.py and can execute arbitrary Python code.