Back to Database
Status published
Medium
CVE-2024-12374
Stored XSS in automatic1111/stable-diffusion-webui
Vulnerability Description
A stored cross-site scripting (XSS) vulnerability exists in automatic1111/stable-diffusion-webui version git 82a973c. An attacker can upload an HTML file, which the application interprets as content-type application/html. If a victim accesses the malicious link, it will execute arbitrary JavaScript in the victim's browser.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-12374
Credits & Attribution
No credits recorded in the NVD database.
More from automatic1111
View All →CVE-2024-12375
Local File Inclusion in automatic1111/stable-diffusion-webui
Medium
6.5
CVE-2024-12074
Denial of Service in automatic1111/stable-diffusion-webui
Medium
6.5
CVE-2024-11045
Cross-Site WebSocket Hijacking (CSWSH) in automatic1111/stable-diffusion-webui
Critical
9.6
CVE-2024-11044
Open Redirect in automatic1111/stable-diffusion-webui
Medium
6.1
CVE-2024-10935
Unauthenticated DoS via Multipart Boundary in automatic1111/stable-diffusion-webui
High
7.5
Affected Vendor
automatic1111
View all reports →Affected Software
automatic1111/stable-diffusion-webui
Vulnerable Versions:
unspecified
Timeline
Official Publish:
March 20th, 2025
Last Modified:
March 20th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N