CVE-2025-31114None▾ SunlitFooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI ma…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
Last analysed / modified upstream
0.5% → 0.9%
Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI may be able to execute arbitrary code on the instance. As of time of publication, no known patched versions are available, but a suggested fix pull request is available.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119121Medium· 4.3Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for
CVE-2024-46946Critical· 9.8LangChain Experimental Eval Injection vulnerability
GHSA-77rh-m34w-rv36CriticalDuplicate Advisory: Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`
CVE-2026-78497High· 8.4JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval
CVE-2026-111865Medium· 5.3THU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injection
CVE-2026-111687Critical· 9.8WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint