CVE-2026-51974

Published: Sep 1, 2026Modified: Sep 2, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An eval() injection vulnerability in the get_list function in modules/meta_parser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file.

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (4)

https://github.com/lllyasviel/Fooocus/blob/main/modules/meta_parser.py#L89

Source: cve@mitre.org

https://github.com/lllyasviel/Fooocus/issues/4115

Source: cve@mitre.org

https://mrbruh.com/fooocus/

Source: cve@mitre.org

https://github.com/lllyasviel/Fooocus/issues/4115

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.