CVE-2026-111987: A1111 WebUI: stored XSS via safetensors metadata hash

Q: Is CVE-2026-111987 actively exploited?

No confirmed active exploitation of CVE-2026-111987 has been reported, but organizations should still patch proactively.

Q: What systems are affected by CVE-2026-111987?

This vulnerability affects the following AI/ML architecture patterns: Generative image model serving (Stable Diffusion WebUI), Model artifact libraries and LoRA management, Shared or multi-user AI workstation environments, Model supply chain via public model hubs.

Q: What is the CVSS score for CVE-2026-111987?

CVE-2026-111987 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.35%.

MEDIUMCISA: TRACK*

Published October 18, 2026

CISO Take

AUTOMATIC1111 stable-diffusion-webui up to 1.10.1 has a cross-site scripting flaw in how the Extra-Networks card builder handles the `ss_sshs_model_hash` metadata field of a .safetensors file. An attacker who gets a crafted model or LoRA file loaded into the UI can run JavaScript in the browser of whoever views the card. Exploitation needs user interaction and has only low integrity impact (CVSS 4.3), and EPSS is low at 0.46% (62nd percentile). It is not in CISA KEV. The references include a proof-of-concept archive (a1111-sshs-hash-poc.zip), so treat exploit code as public even though our feed does not flag it. The maintainers have not responded to the issue report, so no patched version exists. Do not expose A1111 instances to untrusted networks or users, and only load models from sources you trust. Inspect the `__metadata__` fields of any third-party model files before loading them.

Sources:NVDEPSSATLASvuldb.comGitHub (AUTOMATIC1111/stable-diffusion-webui issue #17500)

What is the risk?

Overall risk is LOW to MEDIUM. The CVSS 4.3 vector is network-reachable, low complexity, no privileges, user interaction required, with only low integrity impact. EPSS is low, there is no KEV listing and no Nuclei template. A PoC archive is linked in the references, which lowers the barrier for opportunistic attackers, and the project has not responded to the issue, so no vendor fix is expected soon. Exposure is highest for shared or internet-facing A1111 instances, where a browser session in the UI may carry access to generation settings, local file paths, or the WebUI API. A single-user instance bound to localhost that loads only self-vetted models is at minimal risk.

How does the attack unfold?

Artifact Crafting

The attacker embeds an XSS payload in the ss_sshs_model_hash field of a .safetensors file's __metadata__ header.

AML.T0011.000

Delivery

The malicious model is distributed via a public model hub, community post, or direct share and placed into the victim's WebUI models directory.

AML.T0058

Exploitation

A user opens the Extra Networks tab, the card builder renders the unsanitized hash, and the JavaScript runs in their browser.

AML.T0049

Impact

The script abuses the user's WebUI session to alter settings, read outputs, or redirect the user, with limited integrity impact.

Artifact Crafting

The attacker embeds an XSS payload in the ss_sshs_model_hash field of a .safetensors file's __metadata__ header.

AML.T0011.000

Delivery

The malicious model is distributed via a public model hub, community post, or direct share and placed into the victim's WebUI models directory.

AML.T0058

Exploitation

A user opens the Extra Networks tab, the card builder renders the unsanitized hash, and the JavaScript runs in their browser.

AML.T0049

Impact

The script abuses the user's WebUI session to alter settings, read outputs, or redirect the user, with limited integrity impact.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
stable-diffusion-webui	—	—	No patch

Do you use stable-diffusion-webui? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 29% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CNone

ILow

ANone

What should I do?

1 step

1) No patched version is listed for the affected product, so track the upstream issue (AUTOMATIC1111/stable-diffusion-webui#17500) and apply any fix or community patch once it exists. 2) Until then, sanitize or escape the ss_sshs_model_hash value in read_metadata_from_safetensors in modules/sd_models.py (HTML-encode output when building cards), or strip non-hex characters from the field. 3) Load only models and LoRAs from trusted publishers and verify hashes. Inspect the __metadata__ JSON header of untrusted .safetensors files before use. 4) Do not expose the WebUI to the internet or to untrusted users. Put it behind authentication (--gradio-auth) or a VPN or reverse proxy, and avoid --listen on shared networks. 5) Add a restrictive Content-Security-Policy at the reverse proxy to limit inline script execution. 6) Detection: scan the model library for metadata fields containing <script, onerror=, javascript: or other HTML in hash fields, and monitor reverse-proxy logs for unexpected API calls from WebUI sessions.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply ChainCode ExecutionFrameworkModelPluginAML.T0011.000- Unsafe AI Artifacts AML.T0049- Exploit Public-Facing Application AML.T0058- Publish Poisoned Models

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 3.1-Risks from third-party resources are monitored and managed

OWASP LLM Top 10

LLM03:2025-Supply Chain

Frequently Asked Questions

What is CVE-2026-111987?

Is CVE-2026-111987 actively exploited?

No confirmed active exploitation of CVE-2026-111987 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-111987?

1) No patched version is listed for the affected product, so track the upstream issue (AUTOMATIC1111/stable-diffusion-webui#17500) and apply any fix or community patch once it exists. 2) Until then, sanitize or escape the `ss_sshs_model_hash` value in `read_metadata_from_safetensors` in modules/sd_models.py (HTML-encode output when building cards), or strip non-hex characters from the field. 3) Load only models and LoRAs from trusted publishers and verify hashes. Inspect the `__metadata__` JSON header of untrusted .safetensors files before use. 4) Do not expose the WebUI to the internet or to untrusted users. Put it behind authentication (--gradio-auth) or a VPN or reverse proxy, and avoid --listen on shared networks. 5) Add a restrictive Content-Security-Policy at the reverse proxy to limit inline script execution. 6) Detection: scan the model library for metadata fields containing `<script`, `onerror=`, `javascript:` or other HTML in hash fields, and monitor reverse-proxy logs for unexpected API calls from WebUI sessions.

What systems are affected by CVE-2026-111987?

This vulnerability affects the following AI/ML architecture patterns: Generative image model serving (Stable Diffusion WebUI), Model artifact libraries and LoRA management, Shared or multi-user AI workstation environments, Model supply chain via public model hubs.

What is the CVSS score for CVE-2026-111987?

CVE-2026-111987 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.35%.

What is the AI security impact?

Affected AI Architectures

Generative image model serving (Stable Diffusion WebUI)Model artifact libraries and LoRA managementShared or multi-user AI workstation environmentsModel supply chain via public model hubs

MITRE ATLAS Techniques

AML.T0011.000Unsafe AI Artifacts

AML.T0049Exploit Public-Facing Application

AML.T0058Publish Poisoned Models

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.10.3

NIST AI RMF: MANAGE 3.1

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

A vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected by this vulnerability is the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Extra-Networks Card Builder. Such manipulation of the argument __metadata__.sshs_model_hash leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Exploitation Scenario

An attacker publishes a popular-looking LoRA or checkpoint on a community model hub, with the safetensors `__metadata__.ss_sshs_model_hash` field set to an HTML/JavaScript payload. A designer on a shared A1111 server downloads the file into the models directory, and later opens the Extra Networks tab. The card builder renders the unsanitized hash value, so the script runs in the victim's browser. It uses the victim's session to call WebUI API endpoints, alter settings, read generation history, or redirect the user to a phishing page. The attacker needs no credentials on the server and only relies on the user loading the model.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.