CVE-2025-31114: Fooocus webui vulnerable to Remote Code Execution

Severity: critical (CVSS 9.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-11 · updated 2026-09-29
Weakness: CWE-95

Description

Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI may be able to execute arbitrary code on the instance. As of time of publication, no known patched versions are available, but a suggested fix pull request is available.

Affected products

lllyasviel Fooocus: through 2.5.5

References

https://github.com/lllyasviel/Fooocus/issues/3552
https://github.com/lllyasviel/Fooocus/pull/4207
https://securitylab.github.com/advisories/GHSL-2024-196_Fooocus/
https://securitylab.github.com/advisories/GHSL-2024-196_Fooocus/

Get alerted when CVE-2025-31114 or the next vulnerability affects your stack