The Fooocus image generation software is vulnerable to remote code execution due to improper input validation, posing a significant risk to server integrity.

The application fails to properly sanitize input within the get_list function located in modules/meta_parser.py. This allows an authenticated attacker to inject malicious Python code into the styles payload of an image file's EXIF metadata, which is then processed by an unsafe eval() call.

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution on the host system. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to full system compromise, unauthorized data access, and potential lateral movement within the network. Organizations relying on this software for production workflows face significant operational and security exposure until the flaw is remediated.

Immediate Action: Review the official project repository for the commit 8da1d3ff68942e2d976675939fe72c95746e366e and apply the fix to the modules/meta_parser.py file immediately.

Proactive Monitoring: Monitor server logs for unusual process execution patterns or unexpected file system modifications originating from the application service account.

Compensating Controls: Implement strict input validation or sanitization routines for all uploaded image files and restrict the application's execution permissions to the minimum necessary to function.

Public Exploit Available: Unknown.

This vulnerability presents a clear and present danger to infrastructure security. Administrators must treat this as a high-priority item and verify their current version of Fooocus. If the version falls within the vulnerable range, apply the referenced code fix immediately or restrict access to the application until a formal vendor patch is verified and deployed.