CVE-2026-108942
Received Received - Intake

Reflected XSS in Clarity Upscaler Extra Networks Card

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulDB

Description
A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98. This impacts the function create_html_for_item of the file modules/ui_extra_networks.py of the component Extra Networks Card Rendering. The manipulation of the argument Description results in cross site scripting. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. All versions in the repository are affected, as the codebase is based on AUTOMATIC1111/stable-diffusion-webui v1.7.0 code. Upstream AUTOMATIC1111/stable-diffusion-webui (v1.8.0, released March 1, 2024) contains the fix. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-108942
EUVD
EUVD-2026-98181

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
philz1337x clarity-upscaler cfbdb842c6c839c8e97741722b8cf9a4b7662d98

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108942 is a stored cross-site scripting (XSS) vulnerability in philz1337x clarity-upscaler. It affects the function create_html_for_item in modules/ui_extra_networks.py. The issue occurs when the Description argument is manipulated, leading to XSS. The attack can be executed remotely.

Detection Guidance

Check for model sidecar files (e.g., .txt, .description.txt, or .json) in your models directory that contain unescaped JavaScript payloads in the description field. Inspect the Extra Networks panel in the WebUI for unexpected behavior or scripts executing. Review files modified around the time of potential exposure.

Impact Analysis

An attacker could inject malicious JavaScript into sidecar files (e.g., .txt or .json). When a victim opens the Extra networks panel in the WebUI, the payload executes. This could lead to arbitrary extension installation and further compromise of the system.

Compliance Impact

This vulnerability, a stored XSS flaw, could potentially violate compliance requirements under GDPR and HIPAA by enabling unauthorized access to user data or session hijacking. Stored XSS may allow attackers to steal sensitive information, manipulate user sessions, or execute malicious actions within the WebUI, compromising data integrity and confidentiality.

Mitigation Strategies

Upgrade to the latest version of clarity-upscaler if available, or apply a patch that escapes the description field using html.escape. Remove any suspicious model bundles with sidecar files containing malicious payloads. Monitor for unauthorized access or unusual activity in the WebUI.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108942. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart