Stored Cross-Site Scripting in Automatic1111 Stable Diffusion WebUI
CVE-2024-12374

6.1MEDIUM

Key Information:

Vendor

Automatic1111

Status
Automatic1111/stable-diffusion-webui
Vendor
CVE Published:
20 March 2025

What is CVE-2024-12374?

A stored cross-site scripting (XSS) issue has been identified in the Automatic1111 Stable Diffusion WebUI, allowing attackers to upload malicious HTML files. When victims access these files, arbitrary JavaScript is executed in their browsers, posing significant security risks. It is crucial for users and administrators to be aware of this vulnerability and implement necessary measures to safeguard against potential exploits.

Affected Version(s)

automatic1111/stable-diffusion-webui <= unspecified

References

https://huntr.com/bounties/3dae386a-f442-4be6-87ef-956606...

CVSS V3.0

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.