Fooocus
Monthly
Remote code execution in Fooocus (lllyasviel/Fooocus) versions 2.5.5 and earlier allows an attacker who can reach the web UI to run arbitrary Python by supplying crafted image metadata that the server passes to eval(). Anyone able to load or import an image whose embedded generation metadata contains malicious Python expressions can achieve full code execution on the host. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but an upstream fix pull request (PR #4207) and a GitHub Security Lab advisory (GHSL-2024-196) both confirm the flaw.
Remote code execution in Fooocus (lllyasviel/Fooocus) versions 2.5.5 and earlier allows an attacker who can reach the web UI to run arbitrary Python by supplying crafted image metadata that the server passes to eval(). Anyone able to load or import an image whose embedded generation metadata contains malicious Python expressions can achieve full code execution on the host. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but an upstream fix pull request (PR #4207) and a GitHub Security Lab advisory (GHSL-2024-196) both confirm the flaw.