CVE-2026-111986 AUTOMATIC1111 CVE debrief

Who should care

Defenders responsible for systems using AUTOMATIC1111 stable-diffusion-webui up to 1.10.1 should assess the potential impact of this vulnerability and prioritize verification and mitigation efforts.

Why it matters

Defenders should prioritize verifying the presence of this vulnerability in their systems and assessing the potential impact of code injection through the get_obj_from_str function, as it allows remote attacks.

• Code injection through the get_obj_from_str function
• Potential remote attacks on systems using AUTOMATIC1111 stable-diffusion-webui up to 1.10.1
• Need for verification of system presence and potential impact

Technical summary

The vulnerability is located in the get_obj_from_str function of the modules/sd_models.py file in the AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. The manipulation of the Target argument leads to code injection, allowing remote attacks. The vulnerability has a CVSS score of 2.1 and a CVSS severity of LOW. Defenders should prioritize verifying the presence of this vulnerability in their systems and assessing the potential impact of code injection through the get_obj_from_str function. The vulnerability allows remote code execution, potentially leading to unauthorized access and data breaches.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their systems and assessing the potential impact.

Recommended defensive actions

• Verify the presence of AUTOMATIC1111 stable-diffusion-webui up to 1.10.1 in your systems
• Assess the potential impact of code injection through the get_obj_from_str function
• Monitor for potential remote attacks
• Consider compensating controls until a patch is available
• Review system logs for suspicious activity
• Implement additional security measures to detect and prevent code injection
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability was publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet. There is no official patch available, and defenders should consider compensating controls until a patch is released. The vulnerability affects AUTOMATIC1111 stable-diffusion-webui up to version 1.10.1, and defenders should verify the presence of this version in their systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.