Stable Diffusion WebUI HTML Injection via Model Filename (RCE Risk)

Vulnerability Summary: HTML Injection (via Model Filename) Vulnerability Overview Vulnerability Type: HTML Injection (Not XSS, as scripts execute within the WebUI context, not the browser) Trigger Condition: Injecting malicious HTML/JS code via the model filename in the "Extra Networks" card Impact Mechanism: - The model filename is directly embedded into the WebUI HTML page without escaping or filtering - Attackers can construct filenames containing tags (e.g., ) - When the user loads this model, the malicious script executes within the WebUI page context (not browser sandbox), allowing access to the local file system, initiating network requests, etc. Risk Level: High (Can execute arbitrary JS code, potentially leading to data leakage or remote code execution) Impact Scope Affected Components: WebUI's "Extra Networks" feature (model card display) Affected Versions: All Stable Diffusion WebUI versions as of the report publication (2024) that have not been patched Affected Users: Users deploying WebUI locally and loading custom model files Attack Surface: Any model file downloadable by the user (e.g., .safetensors, .ckpt, etc.), provided the filename contains malicious HTML/JS Remediation Official Fix: - Perform HTML entity escaping before rendering the model filename (e.g., → , → ) - Prohibit the use of dangerous tags like in filenames - Implement whitelist filtering for model filenames (allowing only safe characters like letters, numbers, underscores, hyphens, etc.) Temporary Mitigation: - Users should avoid loading model files from untrusted sources - Administrators can manually clean suspicious filenames in the model directory - Use browser extensions or proxy tools to intercept and block abnormal script execution POC / Exploit Code > Note: This vulnerability is not traditional XSS, but "HTML Injection," where scripts run within the WebUI's Node.js environment or Electron context, with higher privileges. Additional Information Report ID: #17457 Reporter: @benjamin Status: Confirmed Fix Status: Pending Fix Related Project: Stable Diffusion WebUI (AUTOMATIC1111)

Goal Reached Thanks to every supporter — we hit 100%!

Stable Diffusion WebUI HTML Injection via Model Filename (RCE Risk)