EUVD-2025-210684Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Default Fooocus web UI is unauthenticated (PR:N) and eval() is reached with a simple crafted metadata request (AC:L, UI:N), yielding full host compromise (C/I/A:H); network exposure is the practical gating factor.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI may be able to execute arbitrary code on the instance. As of time of publication, no known patched versions are available, but a suggested fix pull request is available.
AnalysisAI
Remote code execution in Fooocus (lllyasviel/Fooocus) versions 2.5.5 and earlier allows an attacker who can reach the web UI to run arbitrary Python by supplying crafted image metadata that the server passes to eval(). Anyone able to load or import an image whose embedded generation metadata contains malicious Python expressions can achieve full code execution on the host. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but an upstream fix pull request (PR #4207) and a GitHub Security Lab advisory (GHSL-2024-196) both confirm the flaw.
Technical ContextAI
Fooocus is a Gradio-based front end for Stable Diffusion image generation. The vulnerable code lives in modules/meta_parser.py, which parses metadata embedded in image files (resolution, guidance, inpaint parameters, LoRA hashes, etc.). Multiple parsing helpers - get_str, get_steps, get_inpaint_method, get_adm_guidance and to_json - call Python's built-in eval() directly on attacker-influenced metadata strings such as data['resolution']. Because eval() executes arbitrary Python, any metadata field routed through it becomes a code-injection sink. The upstream fix (PR #4207) replaces every eval() with ast.literal_eval(), which only evaluates literal structures (tuples, numbers, strings) and cannot invoke code. Although NVD classifies this as CWE-434 (Unrestricted Upload of File with Dangerous Type) - reflecting that the vector is a crafted image/metadata file - the underlying root cause is code injection via unsafe deserialization/evaluation (closer to CWE-95/CWE-502). The affected package is identified by CPE cpe:2.3:a:lllyasviel:fooocus:*.
RemediationAI
No vendor-released patched version was available at time of analysis; an upstream fix is available as a pull request (PR #4207, https://github.com/lllyasviel/Fooocus/pull/4207) but not yet as a tagged release, so a released patched version is not independently confirmed. The concrete fix is to replace every eval() call in modules/meta_parser.py with ast.literal_eval() as done in that PR - operators can apply the diff manually while awaiting an official release. Until then, restrict exposure: bind the Fooocus/Gradio server to localhost (127.0.0.1) rather than 0.0.0.0, place it behind an authenticating reverse proxy or VPN, and do not import or load images from untrusted sources, since malicious metadata is the delivery vector (trade-off: this blocks legitimate metadata import and shared/remote access). Review the GitHub Security Lab advisory (https://securitylab.github.com/advisories/GHSL-2024-196_Fooocus/) and issue #3552 (https://github.com/lllyasviel/Fooocus/issues/3552) for the authoritative fix status.
Share
External POC / Exploit Code
Leaving vuln.today