CVE-2026-51974

HighCVSS 8.8

Published: 01/09/2026(UTC)Updated: 08/09/2026(UTC)Translated: 02/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

35th percentile - higher than 35% of all known CVEs

Summary

An eval() injection vulnerability in the get_list function in modules/meta_parser.py in Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file.

Risk Assessment

An attacker can take control of the system by executing malicious code, potentially leading to data theft or full compromise.

Recommendation

Update Fooocus to a patched version and restrict the ability to upload images with EXIF metadata.

Other vulnerabilities in Fooocus

CVE-2025-31114Critical
Fooocus up to version 2.5.5 is vulnerable to remote code execution due to unsafe use of eval when processing metadata JSON. An attacker with web UI access can execute arbitrary code.

Original NVD description (English source)

An eval() injection vulnerability in the get_list function in modules/meta_parser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS