CVE-2026-111987Published
AUTOMATIC1111 stable-diffusion-webui Extra-Networks Card Builder sd_models.py read_metadata_from_safetensors cross site scripting
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-111987 · Microsoft / collected KEV context
cve-program · CVE-2026-111987
- https://vuldb.com/vuln/421653
- https://vuldb.com/vuln/421653/cti
- https://vuldb.com/cve/CVE-2026-111987
- https://vuldb.com/submit/1006710
- https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17500
- https://github.com/user-attachments/files/32834382/a1111-sshs-hash-poc.zip
- https://github.com/AUTOMATIC1111/stable-diffusion-webui/
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.