← Back to feed
2026-10-19 Model Poisoning TLP:CLEAR

Stable Diffusion Web UI CVE-2026-111986 Lets a YAML Sidecar Beside a Model Run Python

Date: 2026-10-19
Tags: model-poisoning

Executive Summary

VulDB published four CVE records against AUTOMATIC1111 stable-diffusion-webui, and CVE-2026-111986 is code injection in get_obj_from_str that executes arbitrary Python from a same basename YAML file placed next to a model checkpoint. Any user who loads an untrusted safetensors model together with its sidecar YAML on versions up to 1.10.1 can trigger code execution with the privileges of the web UI process. Defenders should treat downloaded model folders as executable content and isolate or review any YAML that shares a checkpoint's basename.

Campaign Summary

FieldDetail
Campaign / MalwareStable Diffusion web UI YAML sidecar code injection
AttributionUnknown (confidence: none)
TargetUsers of AUTOMATIC1111 stable-diffusion-webui up to version 1.10.1 who load third party checkpoints
VectorDownloaded model checkpoint delivered alongside a same basename YAML file
Statusactive
First Observed2026-10-19

Detailed Findings

According to severitydaily.com, VulDB published four CVE records against AUTOMATIC1111 stable-diffusion-webui between 11:45 a.m. and 1:15 p.m. UTC on 2026-10-19, all affecting versions up to 1.10.1 and all crediting reporter r1ck99. In CVE-2026-111986 the file that runs the attacker code is not the model. The chain starts in find_checkpoint_config_near_filename in modules/sd_models_config.py, which strips a checkpoint extension, appends .yaml, and returns that file if it exists, meaning any same basename YAML next to the model is picked up. load_model then parses it with OmegaConf, repair_config sets use_ema to False when the config does not specify it, and instantiate_from_config hands the YAML target string to get_obj_from_str, which resolves it through getattr on an imported module with no allow list or namespace restriction and calls the result with the YAML params as keyword arguments. Severity Daily reported the record was scored 6.3 while the reporter requested 8.8, and each record notes the project was informed early through an issue report but has not responded.

IOCs

Domains

_No IOCs published. Affected product is a self hosted web UI, not a package registry artefact._

Full URL Paths

_No IOCs published. Affected product is a self hosted web UI, not a package registry artefact._

Splunk Format

_No IOCs available for Splunk query_

Affected Platforms

AUTOMATIC1111 stable-diffusion-webui <= 1.10.1

Detection Recommendations

Treat model download folders as untrusted input. Alert on YAML files that share a checkpoint's basename and on imports of unusual modules during model load. Restrict the web UI process to a low privilege account and monitor for Python execution originating from the web UI. Patch or vendor fix the get_obj_from_str path and stop loading sidecar YAML from untrusted sources.

References