Clarity Upscaler CVE-2026-108942

Exploitation requires a low-privileged authenticated actor (PR:L) who can set or influence the 'Description' metadata of an Extra Networks card - for example by introducing a crafted model/network file whose card metadata is rendered by create_html_for_item - and a second victim user must subsequently view that card in the Extra Networks UI (passive user interaction, UI:P). Limiting factors: the flaw is only meaningfully reachable on deployments that serve multiple users or load untrusted/third-party model files; a default single-user local WebUI where the operator controls all model metadata has little realistic exposure. Impact is confined to the victim's browser context (low integrity impact, no confidentiality or availability impact per the vector).

This is a medium-severity, low-priority issue in practice. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N, score 5.1) describes a network-reachable but authenticated (PR:L) stored cross-site scripting flaw that additionally requires passive victim interaction (UI:P) and yields only low integrity impact with no confidentiality or availability impact. No EPSS score was supplied in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no public exploit code is referenced - only a VulDB entry and an unanswered upstream issue report exist. There is no conflict between the signals: all of them point to a constrained, operator/multi-user-dependent XSS rather than a mass-exploitable RCE. The combination of required low-level authentication plus required user interaction means this is a real-priority finding only for deployments that expose the WebUI to multiple or untrusted users; for the common single-user local deployment the practical risk is minimal. Note that EPSS data is entirely absent and should be checked separately before final prioritization.

On a multi-user or internet-exposed Clarity Upscaler / stable-diffusion-webui instance, a low-privileged user supplies a model or network-card whose Description metadata contains a malicious script payload. When another user (e.g., an administrator) opens the Extra Networks tab and the card is rendered by create_html_for_item, the unescaped Description executes JavaScript in the victim's browser session. No public exploit code is identified at time of analysis.