CVE-2026-51974 Overview
CVE-2026-51974 is an eval() injection vulnerability in the get_list function within modules/meta_parser.py in lllyasviel Fooocus versions 2.1.854 through 2.5.5. Fooocus is an open-source image generation interface built on Stable Diffusion. Remote attackers can execute arbitrary Python code by embedding a crafted styles payload in the EXIF metadata of an uploaded image file. The flaw is classified under CWE-94: Improper Control of Generation of Code.
Critical Impact
Authenticated remote attackers can achieve arbitrary Python code execution on the Fooocus host by uploading a single image containing crafted EXIF metadata.
Affected Products
- lllyasviel Fooocus 2.1.854 through 2.5.5
- modules/meta_parser.py component (get_list function)
- Deployments exposing the Fooocus web interface to untrusted image uploads
Discovery Timeline
- 2026-09-01 - CVE-2026-51974 published to the National Vulnerability Database (NVD)
- 2026-09-02 - Last updated in the NVD database
Technical Details for CVE-2026-51974
Vulnerability Analysis
Fooocus parses metadata embedded in uploaded PNG and JPEG files to reconstruct prior generation parameters, including the list of styles applied to an image. The get_list function in modules/meta_parser.py passes attacker-controllable string values from EXIF metadata into Python's built-in eval() function. Because eval() executes any valid Python expression, attacker-supplied metadata is treated as executable code rather than data. The result is arbitrary code execution in the context of the Fooocus process.
Exploitation requires the attacker to submit an image through the application, which typically means access to the Fooocus interface. Successful exploitation compromises confidentiality, integrity, and availability of the host, and can be used to pivot into local model files, API keys, or connected cloud resources.
Root Cause
The root cause is unsafe evaluation of untrusted input. Instead of parsing the styles field as structured data with json.loads, ast.literal_eval, or an explicit allowlist, the code calls eval() directly on strings extracted from image metadata. Attackers control the content of those strings by writing arbitrary values into the EXIF fields of any file they upload.
Attack Vector
The attack is delivered over the network via the standard image upload workflow. An attacker crafts an image whose EXIF metadata contains a Python expression in the styles field. When Fooocus imports parameters from that image, get_list invokes eval() on the payload and executes it. Refer to the GitHub issue #4115 and the annotated meta_parser.py source for the vulnerable code path, and the MrBruh Fooocus writeup for exploitation context.
No verified proof-of-concept code is included here. Consult the referenced advisories for technical details.
Detection Methods for CVE-2026-51974
Indicators of Compromise
- Unexpected Python child processes spawned by the Fooocus server process after an image upload event.
- Outbound network connections from the Fooocus host to unfamiliar IP addresses or domains immediately following metadata parsing.
- Newly written files, cron entries, or systemd units under the account running Fooocus.
- Image files whose EXIF styles or user-comment fields contain Python syntax such as __import__, os.system, or subprocess.
Detection Strategies
- Inspect uploaded images with exiftool and flag metadata fields that contain Python keywords, function calls, or shell metacharacters.
- Monitor the Fooocus process tree for spawned interpreters, shells, or network utilities that are not part of normal image generation.
- Enable Python audit hooks (sys.addaudithook) to log invocations of eval, exec, and compile during metadata import.
Monitoring Recommendations
- Forward Fooocus application logs and host process telemetry to a centralized analytics platform for correlation across upload, parse, and execution events.
- Alert on anomalous outbound traffic from GPU or inference hosts, which typically have narrow network profiles.
- Track file integrity on the Fooocus installation directory and user home directory to catch attacker persistence.
How to Mitigate CVE-2026-51974
Immediate Actions Required
- Restrict access to the Fooocus web interface to trusted users on isolated network segments until an upstream fix is applied.
- Disable the metadata import feature or block uploads of images containing EXIF or PNG text chunks.
- Run Fooocus as an unprivileged user inside a container or sandbox with no outbound internet access by default.
- Audit existing image libraries and generation histories for malicious EXIF payloads.
Patch Information
At the time of publication, no fixed release is referenced in the NVD entry for CVE-2026-51974. Track the Fooocus GitHub issue #4115 and the project's release notes for an official patch. Once available, upgrade to the fixed version and validate that modules/meta_parser.py no longer calls eval() on metadata-derived strings.
Workarounds
- Patch the local copy of modules/meta_parser.py to replace eval() with ast.literal_eval() or a JSON parser that rejects executable expressions.
- Strip EXIF and PNG text metadata from all uploaded images at an upstream proxy using tools such as exiftool -all=.
- Apply an allowlist of expected style identifiers and reject any value that does not match a known-good token.
- Enforce mandatory access controls (AppArmor, SELinux, or seccomp) to limit what the Fooocus process can execute or reach on the network.
# Configuration example: strip metadata from uploads before Fooocus processes them
exiftool -all= -overwrite_original /path/to/uploads/*.png /path/to/uploads/*.jpg
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
