Medium severity · published Oct 18, 2026
CVE-2026-111986
AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_str of the file modules/sd_models.py of the component Model Instantiation. This manipulation of the argument Target causes code injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
stable-diffusion-webui · AUTOMATIC1111
1.10.0; 1.10.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111986
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111986
github.com
https://github.com/AUTOMATIC1111/stable-diffusion-webui/
github.com
https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17499
github.com
https://github.com/user-attachments/files/32834193/a1111-yaml-target-poc.zip
vuldb.com
https://vuldb.com/cve/CVE-2026-111986
vuldb.com
https://vuldb.com/submit/1006657
vuldb.com
https://vuldb.com/vuln/421652
More from stable-diffusion-webui
9.6
CVE-2024-11045
Cross-Site WebSocket Hijacking (CSWSH) in automatic1111/stable-diffusion-webui
7.5
CVE-2026-82288
Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags
7.5
CVE-2024-10935
Unauthenticated DoS via Multipart Boundary in automatic1111/stable-diffusion-webui
6.5
CVE-2024-12074
Denial of Service in automatic1111/stable-diffusion-webui
6.5
CVE-2024-12375
Local File Inclusion in automatic1111/stable-diffusion-webui