From 63097ff9cf1a277265f0932a3c68450fbc84203d Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 21 Mar 2025 15:34:27 +0000
Subject: [PATCH] Publish GHSA-mcrp-whpw-jp68

---
 .../GHSA-mcrp-whpw-jp68.json                  | 69 +++++++++++++++++++
 1 file changed, 69 insertions(+)
 create mode 100644 advisories/github-reviewed/2025/03/GHSA-mcrp-whpw-jp68/GHSA-mcrp-whpw-jp68.json

diff --git a/advisories/github-reviewed/2025/03/GHSA-mcrp-whpw-jp68/GHSA-mcrp-whpw-jp68.json b/advisories/github-reviewed/2025/03/GHSA-mcrp-whpw-jp68/GHSA-mcrp-whpw-jp68.json
new file mode 100644
index 00000000000..e4b42372546
--- /dev/null
+++ b/advisories/github-reviewed/2025/03/GHSA-mcrp-whpw-jp68/GHSA-mcrp-whpw-jp68.json
@@ -0,0 +1,69 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-mcrp-whpw-jp68",
+  "modified": "2025-03-21T15:32:15Z",
+  "published": "2025-03-21T15:32:15Z",
+  "aliases": [
+    "CVE-2024-12029"
+  ],
+  "summary": "InvokeAI Deserialization of Untrusted Data vulnerability",
+  "details": "A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can exploit this by embedding malicious code in model files, which is executed upon loading. This issue is fixed in version 5.4.3.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "InvokeAI"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "5.3.1"
+            },
+            {
+              "fixed": "5.4.3rc1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12029"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/invoke-ai/invokeai/commit/756008dc5899081c5aa51e5bd8f24c1b3975a59e"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/invoke-ai/InvokeAI"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/invokeai/PYSEC-2025-9.yaml"
+    },
+    {
+      "type": "WEB",
+      "url": "https://huntr.com/bounties/9b790f94-1b1b-4071-bc27-78445d1a87a3"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-502"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-03-21T15:32:15Z",
+    "nvd_published_at": "2025-03-20T10:15:26Z"
+  }
+}
\ No newline at end of file