CVE-2026-111986Published
AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-111986 · Microsoft / collected KEV context
cve-program · CVE-2026-111986
- https://vuldb.com/vuln/421652
- https://vuldb.com/vuln/421652/cti
- https://vuldb.com/cve/CVE-2026-111986
- https://vuldb.com/submit/1006657
- https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17499
- https://github.com/user-attachments/files/32834193/a1111-yaml-target-poc.zip
- https://github.com/AUTOMATIC1111/stable-diffusion-webui/
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.