AUTOMATIC1111 stable-diffusion-webui vulnerabilities

12 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Latest AUTOMATIC1111 stable-diffusion-webui vulnerabilities

CVE-2026-111987 — AUTOMATIC1111 stable-diffusion-webui Extra-Networks Card Builder sd_models.py read_metadata_from_safetensors cross site scripting (CVSS 4.3)
CVE-2026-111986 — AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection (CVSS 6.3)
CVE-2026-111985 — AUTOMATIC1111 stable-diffusion-webui Metadata Extraction sd_models.py read_metadata_from_safetensors allocation of resources (CVSS 4.3)
CVE-2026-111984 — AUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scripting (CVSS 4.3)
CVE-2026-82288 — Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags (CVSS 7.5)
CVE-2024-12375 — Local File Inclusion in automatic1111/stable-diffusion-webui (CVSS 6.5)
CVE-2024-12374 — Stored XSS in automatic1111/stable-diffusion-webui (CVSS 6.1)
CVE-2024-12074 — Denial of Service in automatic1111/stable-diffusion-webui (CVSS 6.5)
CVE-2024-11045 — Cross-Site WebSocket Hijacking (CSWSH) in automatic1111/stable-diffusion-webui (CVSS 9.6)
CVE-2024-11044 — Open Redirect in automatic1111/stable-diffusion-webui (CVSS 6.1)
CVE-2024-10935 — Unauthenticated DoS via Multipart Boundary in automatic1111/stable-diffusion-webui (CVSS 7.5)
CVE-2024-31462 — Limited file write in Stable-diffusion-webui - GHSL-2024-010 (CVSS 6.3)