CVE-2025-31114 lllyasviel CVE debrief

Who should care

Defenders responsible for Fooocus instances, especially those exposed to the internet, should assess their exposure and consider applying the suggested fix or other compensating controls. IT teams managing image generating software and security teams focused on web application vulnerabilities should also prioritize this issue.

Why it matters

CVE-2025-31114 is a critical remote code execution vulnerability in Fooocus, an image generating software. Defenders should prioritize verifying exposure, applying patches or compensating controls, and monitoring for updates due to the high CVSS score of 9.3 and the potential for arbitrary code execution.

• Potential remote code execution on Fooocus instances
• Possible unauthorized access to sensitive data or systems
• Required verification of instance exposure and vulnerability status
• Need for timely application of patches or compensating controls

Technical summary

The Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. This allows an attacker with access to the web UI to potentially execute arbitrary code on the instance. The vulnerability affects versions 2.5.5 and prior of the Fooocus software. Defenders should prioritize verifying exposure of Fooocus instances, especially those exposed to the internet, and consider applying the suggested fix or other compensating controls until an official patch is released. The vulnerability has a CVSS score of 9.3, indicating a critical severity level.

Defensive priority

Defenders should prioritize verifying exposure of Fooocus instances, especially those exposed to the internet, and consider applying the suggested fix or other compensating controls until an official patch is released.

Recommended defensive actions

• Verify Fooocus instance exposure, especially those accessible to the internet
• Review and apply the suggested fix pull request if feasible
• Monitor for official patches or updates from the vendor
• Consider implementing compensating controls, such as restricting access to the Fooocus web UI
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected versions. However, the exact scope of affected deployments and instances remains unknown. Defenders should verify exposure of Fooocus instances, especially those exposed to the internet, and review the suggested fix pull request for potential applicability. The lack of official patches and the potential for remote code execution emphasize the need for timely verification and mitigation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.