The vulnerability resides in the get_obj_from_str function within the Model Instantiation component of AUTOMATIC1111 stable‑diffusion‑webui. By supplying a specially crafted Target string, an attacker can inject code that the function evaluates, enabling arbitrary code execution. The flaw is a classic code‑injection and string‑to‑object misuse, captured as CWE‑74 and CWE‑94. Successful exploitation would give the attacker control over the host system running the web UI, compromising confidentiality, integrity, and availability.

The issue affects all releases of stable‑diffusion‑webui numbered 1.10.1 or earlier. Any deployment of AUTOMATIC1111’s web UI that uses the default configuration and exposes the Model Instantiation endpoint to unauthenticated users is potentially impacted. The affected product is the stable‑diffusion‑webui component, version up to 1.10.1.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available, and the vulnerability is not yet listed in CISA’s KEV catalog. The attack vector is remote; an attacker simply needs network access to the web UI to send a malicious Target parameter. Because the exploit has been publicly disclosed and the vendor has not yet released a fix, the risk remains significant until a patch is applied or mitigation measures are in place.