Fooocus, an image generation tool, contains a critical flaw in its web UI. The application processes metadata JSON by invoking JavaScript's eval function without validating the input, allowing an attacker who can submit data to the web UI to execute arbitrary code on the server. This is a classic arbitrary code execution weakness (CWE‑95) and could compromise confidentiality, integrity, and availability of the entire instance.

The flaw affects the Fooocus web UI supplied by the lllyasviel project. All releases up to and including version 2.5.5 are vulnerable. No fixed release was available at the time of discovery, although a pull request containing the fix exists.

The CVSS score of 9.3 indicates a critical severity. Based on the description, the likely attack vector is through the publicly accessible web UI that accepts metadata JSON; an attacker can submit specially crafted data to trigger eval and execute code. With no publicly known exploits and an EPSS score of <1%, exploitation is considered unlikely but possible. The vulnerability’s impact would allow an attacker to compromise confidentiality, integrity and availability of the entire instance. The CVE is not listed in the CISA KEV catalog, so official advisories are limited.