Stable Diffusion WebUI CVE-2026-111986

Requires the victim to load an attacker-supplied Stable Diffusion model whose accompanying YAML configuration sets the 'target' argument to an attacker-chosen class/callable, which get_obj_from_str then imports and instantiates - i.e., exploitation depends on loading untrusted third-party model configs. Limiting factors: user interaction is mandatory (UI:P - the victim must load the malicious model/config); there is no self-propagation or default-config remote trigger. Affects stable-diffusion-webui up to and including 1.10.1; no authentication is needed on the attacker side (PR:N), as the payload rides in distributed model files rather than requiring access to the target instance.

Signals conflict sharply and must be weighed carefully. The input CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L, score 2.1 Low) rates impact as only Low across confidentiality, integrity, and availability - yet the vulnerability is CWE-94 code injection via get_obj_from_str, which dynamically imports and instantiates an attacker-named class and therefore realistically yields full arbitrary code execution on the host. That Low impact rating (assigned by VulDB, the sole reporting source) appears understated for a code-injection primitive and should be treated with skepticism; I assess the true impact as High (see assessed vectors). The genuine risk-limiting factor is UI:P - exploitation requires the victim to load an attacker-supplied model/config (the POC is a YAML file abusing the 'target' field), so this is a supply-chain / social-engineering vector rather than a drive-by remote exploit. A public POC exists (a1111-yaml-target-poc.zip), but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. Net: not a drop-everything internet-facing emergency, but a meaningful RCE risk for anyone who loads untrusted third-party Stable Diffusion models/configs, compounded by the vendor having not responded to issue #17499 and no patch existing. Note the AV:N/impact conflict explicitly: network vector is nominal (model delivered over the network) but code execution hinges on user-initiated model loading - verify against the vendor, who has not yet responded.

An attacker publishes a Stable Diffusion checkpoint on a model-sharing site accompanied by a crafted YAML config whose 'target' field names an arbitrary Python callable. When a victim loads that model in stable-diffusion-webui, get_obj_from_str in modules/sd_models.py imports and instantiates the attacker-controlled target, executing arbitrary code on the victim's machine. A public proof-of-concept (a1111-yaml-target-poc.zip) demonstrating this exists.