CVE-2026-108942 philz1337x CVE debrief

Who should care

Defenders responsible for the security of systems using philz1337x clarity-upscaler should assess their exposure and verify the version in use. Defenders should prioritize verifying the version of clarity-upscaler in use and checking for the presence of the fix in version v1.8.0 or later to prevent cross-site scripting attacks. The vulnerability can be exploited remotely, allowing an attacker to inject malicious code.

Why it matters

Defenders should prioritize verifying the version of clarity-upscaler in use and checking for the presence of the fix in version v1.8.0 or later to prevent cross-site scripting attacks.

• Defenders should verify the version of clarity-upscaler in use and check for the presence of the fix in version v1.8.0 or later to prevent cross-site scripting attacks.
• The vulnerability can be exploited remotely, allowing an attacker to inject malicious code.
• The attack can result in cross-site scripting, potentially leading to unauthorized actions or data theft.

Technical summary

The vulnerability is caused by a lack of proper sanitization of user input in the create_html_for_item function of the modules/ui_extra_networks.py file. This allows an attacker to inject malicious code, resulting in cross-site scripting. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. All versions in the repository are affected, as the codebase is based on AUTOMATIC1111/stable-diffusion-webui v1.7.0 code.

Defensive priority

Defenders should prioritize verifying the version of clarity-upscaler in use and checking for the presence of the fix in version v1.8.0 or later.

Recommended defensive actions

• Verify the version of clarity-upscaler in use and check for the presence of the fix in version v1.8.0 or later.
• Review the code in modules/ui_extra_networks.py to ensure that user input is properly sanitized.
• Implement additional security measures to prevent cross-site scripting attacks.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to additional information. The vulnerability is caused by a lack of proper sanitization of user input in the create_html_for_item function of the modules/ui_extra_networks.py file. This allows an attacker to inject malicious code, resulting in cross-site scripting. Defenders should verify the version of clarity-upscaler in use and check for the presence of the fix in version v1.8.0 or later. The project was

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.