Clarity Upscaler
Monthly
Stored cross-site scripting in philz1337x/clarity-upscaler allows a low-privileged authenticated user to execute script in another user's browser by manipulating the Description metadata of an Extra Networks card, which is then rendered unescaped by create_html_for_item in modules/ui_extra_networks.py. Every repository version is affected because the project ships as a rolling release whose codebase descends from AUTOMATIC1111/stable-diffusion-webui v1.7.0; the upstream project fixed the same flaw in v1.8.0 (March 1, 2024), but clarity-upscaler's maintainers were notified early via an issue report and have not responded. No public exploit has been identified at time of analysis, and practical exposure is limited to multi-user instances or deployments that load untrusted third-party model files, since a single-user local WebUI where the operator controls all card metadata has little realistic risk; this is assessed as a medium-severity, low-priority issue in practice.
Stored cross-site scripting in philz1337x/clarity-upscaler allows a low-privileged authenticated user to execute script in another user's browser by manipulating the Description metadata of an Extra Networks card, which is then rendered unescaped by create_html_for_item in modules/ui_extra_networks.py. Every repository version is affected because the project ships as a rolling release whose codebase descends from AUTOMATIC1111/stable-diffusion-webui v1.7.0; the upstream project fixed the same flaw in v1.8.0 (March 1, 2024), but clarity-upscaler's maintainers were notified early via an issue report and have not responded. No public exploit has been identified at time of analysis, and practical exposure is limited to multi-user instances or deployments that load untrusted third-party model files, since a single-user local WebUI where the operator controls all card metadata has little realistic risk; this is assessed as a medium-severity, low-priority issue in practice.