CVE-2026-108942

Name of the Vulnerable Software and Affected Versions philz1337x clarity-upscaler versions up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98

Description A remote cross site scripting issue exists in the Extra Networks Card Rendering component. The flaw occurs within the create html for item() function located in the modules/ui extra networks.py file, where improper handling of the Description argument allows for the execution of malicious scripts.

Recommendations Update to a version based on AUTOMATIC1111/stable-diffusion-webui v1.8.0 or later. As a temporary workaround, restrict or sanitize the input provided to the Description argument in the create html for item() function.