A flaw in the clarity‑upscaler project allows a malicious Description argument supplied to the create_html_for_item function in modules/ui_extra_networks.py to be rendered without proper sanitization, resulting in cross‑site scripting. The vulnerability is rooted in improper handling of user input (CWE‑79) and could be leveraged to inject arbitrary code that executes in the browser context of any user who views the affected card rendering. The description does not mention server‑side code execution, so the primary impact is client‑side script injection and potential credential theft or defacement.

All versions of the clarity‑upscaler repository, up to commit cfbdb842c6c839c8e97741722b8cf9a4b7662d98, are affected. The code originates from AUTOMATIC1111/stable‑diffusion‑webui v1.7.0 and the upstream project released a fix in v1.8.0 on March 1, 2024. Because the package follows a rolling release model, precise versioning is unclear, but any clone that predates the v1.8.0 fix remains vulnerable.

The CVSS score of 5.1 places the vulnerability in the medium range, and no EPSS data is available, indicating that the present under‑utilization or lack of data prevents a precise estimate of exploitation likelihood. The vulnerability is not listed in CISA KEV, and no public exploits have been reported. The attack vector is remote, achievable via the web interface or API that invokes create_html_for_item, allowing an attacker to supply a crafted Description that is then rendered as part of the UI.