CVE-2025-31114

CVE-2025-31114 is a remote code execution vulnerability in Fooocus, an open-source AI image generation tool. The flaw is an unsafe eval() call when parsing metadata embedded in user-supplied images — specifically, the application treats JSON metadata attached to images as trusted rather than untrusted input, allowing attackers to embed malicious payloads that execute server-side code upon image upload or processing. The CVSS score of 9.3 reflects the severity, but the disclosure posture is the more troubling dimension. A suggested fix PR exists in the repository, yet no patched release was available at CVE publication. That gap is not merely a release velocity issue — it reveals a structural accountability gap in how the project handles security. The absence of a formal patch indicates that Fooocus lacks the security release infrastructure required to respond to critical vulnerabilities: no established path from vulnerability disclosure to a versioned artifact on PyPI with appropriate changelog and regression testing. For a web-facing application processing untrusted user content, this capability gap is a compounding risk window — every day without a patched release is a day where the CVE itself serves as an exploitation roadmap. The deeper architectural problem is that Fooocus is a wrapper project — a UI layer over Stable Diffusion designed to make image generation accessible. This creates predictable development incentives: contributors iterate fast on user-facing features, treating the underlying image processing stack as someone else's security surface. The eval() in metadata parsing likely entered not from ignorance but from the assumption that core infrastructure is inherited responsibility. Until a project explicitly assigns ownership for trust boundaries at metadata ingestion, this pattern will recur. For defenders, the immediate action is to audit whether Fooocus instances are exposed to untrusted image input — including images from shared model platforms, community forks, or automated pipelines. Treat all image metadata as fully untrusted. Beyond patching, evaluate whether your deployment model receives automatic security updates or if you are running a fragmented installation (Docker, community forks) that may never receive the fix. The blast radius of this vulnerability extends beyond the Fooocus instance itself: image metadata passes downstream into workflows that assume provenance, creating a failure cascade if exploited.

Reviewed through automated stages and approved by a human before publication.