{"id":"CVE-2026-108942","summary":"philz1337x clarity-upscaler Extra Networks Card Rendering ui_extra_networks.py create_html_for_item cross site scripting","details":"A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98. This impacts the function create_html_for_item of the file modules/ui_extra_networks.py of the component Extra Networks Card Rendering. The manipulation of the argument Description results in cross site scripting. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. All versions in the repository are affected, as the codebase is based on AUTOMATIC1111/stable-diffusion-webui v1.7.0 code. Upstream AUTOMATIC1111/stable-diffusion-webui (v1.8.0, released March 1, 2024) contains the fix. The project was informed of the problem early through an issue report but has not responded yet.","modified":"2026-10-15T02:30:45.508191142Z","published":"2026-10-13T00:00:13.139Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-79","CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108942.json"},"references":[{"type":"WEB","url":"https://github.com/philz1337x/clarity-upscaler/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108942.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108942"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-108942"},{"type":"ADVISORY","url":"https://vuldb.com/submit/997640"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/416767"},{"type":"REPORT","url":"https://github.com/philz1337x/clarity-upscaler/issues/72"},{"type":"REPORT","url":"https://vuldb.com/vuln/416767/cti"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/philz1337x/clarity-upscaler","events":[{"introduced":"cfbdb842c6c839c8e97741722b8cf9a4b7662d98"},{"last_affected":"cfbdb842c6c839c8e97741722b8cf9a4b7662d98"}]}],"versions":["cfbdb842c6c839c8e97741722b8cf9a4b7662d98"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108942.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X"}]}