CVE-2026-51974

Name of the Vulnerable Software and Affected Versions lllyasviel Fooocus versions 2.1.854 through 2.5.5

Description An eval() injection issue exists in the get list() function within modules/meta parser.py. This allows remote attackers to execute arbitrary Python code by providing a specially crafted styles payload inside the EXIF metadata of an uploaded image file. eval() injection occurs when an application passes untrusted input to the eval() function, which executes the input as code.

Recommendations Update lllyasviel Fooocus to a version later than 2.5.5. As a temporary mitigation, restrict the upload of image files containing EXIF metadata until the software is updated.