AUTOMATIC1111 stable-diffusion-webui EUVD-2026-103475

Exploitation requires an attacker-controlled filename for an Extra Networks card (model/LoRA/embedding/hypernetwork) that the 'Card Builder' path renders via create_item_html, plus a victim who opens that view (UI:P / user interaction). Key limiting factors: stable-diffusion-webui defaults to binding on localhost, so remote reach requires the instance to be deliberately network-exposed (--listen or --share); the attacker must first get a maliciously named file into the scanned networks directory; and impact is limited to script execution in the browser with no confidentiality or availability effect (VI:L only). Authentication is not meaningfully applicable because the application typically has no auth layer (PR:N).

This is a medium-severity (CVSS 4.0 base 5.3) stored/DOM cross-site scripting issue (CWE-79) and, weighing all signals, it reads as a genuine-but-low-priority flaw rather than an urgent one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) shows no privileges required but mandatory user interaction (UI:P), no confidentiality or availability impact, and only low integrity impact - consistent with script injection in a UI rather than system compromise. Publicly available exploit code exists (a poc.zip attachment referenced from the GitHub issue), which raises practical risk, but there is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation - POC availability and active exploitation are distinct signals and only the former is present here. The report originates solely from VulDB, the vendor has not responded to the issue report, and no patch exists, which caps confidence. The E:P (Proof-of-Concept) exploit-maturity value in the vector agrees with the stated POC status. Crucially, stable-diffusion-webui is overwhelmingly deployed as a single-user application bound to localhost, so 'remotely' is heavily qualified by the need for the instance to be network-exposed (e.g., --listen/--share) and for the attacker to control a card/model filename - these conditions materially lower real-world risk below what 'AV:N' alone suggests.

An attacker crafts a model/LoRA/embedding file whose filename contains HTML/JavaScript markup and gets it placed into the webui's networks directory (e.g., via a shared model pack, download, or an exposed instance). When a user opens the Extra Networks 'Card Builder' view, create_item_html in modules/ui_extra_networks.py renders the filename without sanitization, executing the script in the victim's browser session. A public proof-of-concept (poc.zip) is referenced from the project's GitHub issue, so a working exploit is available.