Stable Diffusion WebUI CVE-2026-111987

Exploitation requires a victim to load an attacker-controlled safetensors model file in which the __metadata__.sshs_model_hash metadata field contains a crafted script payload; the Extra-Networks Card Builder then renders this value without output encoding, triggering stored/reflected XSS. The key limiting factor is the required user interaction (UI:P) - the attacker cannot trigger this without the victim importing/loading the malicious model, so delivery depends on social engineering or a compromised model repository. No authentication is involved (PR:N), consistent with the typically unauthenticated local webui; there is no server-side code execution and impact is confined to the victim's browser session.

This is a genuine but moderate-severity issue, not a top-tier emergency. The vendor CVSS 4.0 score is 5.3 (medium) with vector AV:N/AC:L/AT:N/PR:N/UI:P, meaning network-reachable and low-complexity but gated by passive user interaction (UI:P) - the victim must load an attacker-supplied model file. The exploitation maturity metric E:P and the referenced GitHub attachment confirm publicly available exploit code exists, but there is NO CISA KEV listing and NO EPSS score was provided in the input, so there is no evidence of active or widespread exploitation - this is a disclosed PoC, not confirmed in-the-wild abuse. The impact is narrow: the 4.0 vector sets VC:N/VI:L/VA:N, i.e. a limited integrity impact (script execution in the victim's browser) with no direct confidentiality or availability loss and no scope/subsequent-system impact. The signals are internally consistent (medium CVSS + PoC-exists + no KEV/EPSS = a real-but-targeted, social-engineering-dependent flaw). The most important caveat: because AUTOMATIC1111 webui is typically run locally without authentication, the practical risk hinges entirely on whether users load untrusted third-party safetensors models - a common behavior in the Stable Diffusion community, which elevates real-world exposure above what the raw 5.3 suggests. Note also the vendor has not responded to the issue report, so no official patch is confirmed available.

An attacker crafts a malicious safetensors model file whose __metadata__.sshs_model_hash field embeds a JavaScript payload and distributes it on a model-sharing site. When a victim loads the model and the Extra-Networks card is rendered, read_metadata_from_safetensors passes the unsanitized value into the page, executing the script in the victim's browser. A public PoC (a1111-sshs-hash-poc.zip) is available, lowering the barrier to reproduction.