CVE-2025-31114 lllyasviel CVE debrief

Who should care

Defenders responsible for Fooocus instances, especially those exposed to the internet, should assess their exposure and consider applying compensating controls. Roles include security teams, system administrators, and developers using Fooocus.

Why it matters

CVE-2025-31114 is a critical remote code execution vulnerability in Fooocus, an image generating software. Defenders should verify exposure, especially for internet-facing instances, and consider applying compensating controls until an official patch is released. The vulnerability allows arbitrary code execution on affected instances, with a CVSS score of 9.3.

• Verify exposure of Fooocus instances to the internet
• Assess the need for compensating controls until an official patch is released
• Prioritize applying the suggested fix or official patch as soon as available

Technical summary

Fooocus, an image generating software, is vulnerable to remote code execution in versions 2.5.5 and prior due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI may be able to execute arbitrary code on the instance. The vulnerability has a CVSS score of 9.3, indicating critical severity. A suggested fix pull request is available, but no patched versions have been officially released. Defenders should prioritize verifying exposure of Fooocus instances, especially those exposed to the internet, and consider applying compensating controls until an official patch is released.

Defensive priority

Defenders should prioritize verifying exposure of Fooocus instances, especially those exposed to the internet, and consider applying the suggested fix or other compensating controls until an official patch is released.

Recommended defensive actions

• Verify Fooocus instance exposure, especially for internet-facing deployments
• Consider applying the suggested fix pull request until an official patch is released
• Monitor for official patch release and apply it as soon as available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected versions. However, the corpus does not establish specific exploitation instances or remediation beyond a suggested fix pull request.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.