CVE-2025-31114: Fooocus Image Generator RCE Vulnerability

CVE-2025-31114 Overview

CVE-2025-31114 is a remote code execution vulnerability in Fooocus, an open-source image generation web application. The flaw exists in versions 2.5.5 and prior, where the web UI processes metadata JSON using unsafe eval() calls. An attacker with access to the Fooocus web UI can execute arbitrary Python code on the underlying host. The vulnerability is categorized as improper control of code generation [CWE-95], commonly known as code injection. At the time of publication, no patched release exists, though a candidate fix has been proposed via GitHub Pull Request #4207.

Critical Impact
Network-reachable attackers with UI access can achieve arbitrary code execution on the Fooocus host, leading to full system compromise, model theft, and lateral movement.

Affected Products

Fooocus versions 2.5.5 and prior
Fooocus web UI component
All deployments exposing the Fooocus interface to untrusted users

Discovery Timeline

2026-08-11 - CVE-2025-31114 published to the National Vulnerability Database (NVD)
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2025-31114

Vulnerability Analysis

Fooocus provides a web-based interface for generating images with diffusion models. The application supports importing metadata embedded in image files or supplied as JSON to reproduce prompts and generation parameters. The metadata parsing routine passes untrusted input into Python's eval() function without sanitization or restricted execution context.

Because eval() interprets its argument as arbitrary Python code, any attacker who can submit metadata to the web UI can execute code with the privileges of the Fooocus process. This typically means full access to model weights, dataset files, credentials stored on the host, and any cloud metadata services reachable from the instance.

The vulnerability is classified under CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code. Details are documented in GitHub Security Advisory GHSL-2024-196 and GitHub Issue #3552.

Root Cause

The root cause is direct use of eval() on attacker-controlled JSON metadata during image import or parameter loading. Safe parsers such as json.loads() should have been used instead. No allowlist, sandbox, or type validation constrains the evaluated expression.

Attack Vector

Exploitation requires network access to the Fooocus web UI. Because Fooocus deployments frequently expose the interface on shared networks, cloud VMs, or public endpoints, the attack surface is broad. An attacker crafts an image or metadata payload containing a Python expression that invokes os.system, subprocess.Popen, or similar primitives. Submitting the payload through the metadata import path triggers the eval() call and executes the embedded code.

No authentication or user interaction is required when the UI is reachable without login, which is the default configuration for many Fooocus installations.

Verified proof-of-concept code has not been published. Refer to the linked advisory and pull request for technical details of the vulnerable code path.

Detection Methods for CVE-2025-31114

Indicators of Compromise

Unexpected child processes spawned by the Python interpreter running Fooocus, such as sh, bash, curl, or wget.
Outbound network connections from the Fooocus host to unfamiliar external endpoints, particularly on non-standard ports.
New or modified files in the Fooocus working directory, model cache, or user home directory that were not created by legitimate generation activity.
Metadata import requests containing Python syntax tokens such as __import__, lambda, or exec in JSON fields.

Detection Strategies

Monitor Fooocus process trees for unauthorized child processes; a well-behaved image generator should not spawn shells or package managers.
Inspect HTTP request bodies to the Fooocus metadata endpoints for JSON values containing Python callables or dunder attributes.
Correlate authentication events with metadata submission bursts to identify probing behavior.

Monitoring Recommendations

Enable process creation logging on hosts running Fooocus and forward events to a centralized analytics platform.
Alert on outbound connections from AI workload hosts to IP ranges outside the expected model and dataset providers.
Track filesystem writes outside the designated output directory as potential post-exploitation activity.

How to Mitigate CVE-2025-31114

Immediate Actions Required

Restrict network access to the Fooocus web UI using firewall rules, reverse proxy authentication, or VPN gating until a patched release is available.
Disable the metadata import feature if it is not required for the deployment's workflow.
Run Fooocus as an unprivileged user inside an isolated container or virtual machine to limit blast radius.
Audit recent metadata submissions and host logs for signs of exploitation described in the detection section.

Patch Information

As of the CVE publication date, no official patched release of Fooocus is available. A community-proposed fix that replaces the unsafe eval() call with a safe JSON parser is tracked in GitHub Pull Request #4207. Operators can review the diff and apply the change locally, or fork the repository and rebuild from the patched source. Monitor the Fooocus repository for an official release incorporating the fix.

Workarounds

Deploy Fooocus behind an authenticating reverse proxy such as nginx with HTTP basic auth or OAuth to prevent anonymous UI access.
Apply the patch from Pull Request #4207 manually by replacing eval() with json.loads() in the metadata parsing routine.
Bind the Fooocus listener to 127.0.0.1 and require SSH tunneling for remote access.
Run the service inside a container with no outbound network access and read-only mounts for sensitive directories.

bash

# Example: restrict Fooocus to localhost and front with authenticated proxy
# Start Fooocus bound to loopback only
python launch.py --listen 127.0.0.1 --port 7865

# nginx snippet enforcing basic auth in front of Fooocus
# location / {
#     auth_basic "Fooocus";
#     auth_basic_user_file /etc/nginx/.htpasswd;
#     proxy_pass http://127.0.0.1:7865;
# }