netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-mcrp-whpw-jp68

Browse Source
This commit is contained in:
advisory-database[bot]
2025-05-20 17:39:19 +00:00
parent 18fd2a5a92
commit b42fac4f59
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2025/03/GHSA-mcrp-whpw-jp68/GHSA-mcrp-whpw-jp68.json
+7 -3
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mcrp-whpw-jp68",
"modified": "2025-03-21T15:32:15Z",
"modified": "2025-05-20T17:37:16Z",
"published": "2025-03-21T15:32:15Z",
"aliases": [
"CVE-2024-12029"
],
"summary": "InvokeAI Deserialization of Untrusted Data vulnerability",
"details": "A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can exploit this by embedding malicious code in model files, which is executed upon loading. This issue is fixed in version 5.4.3.",
"details": "A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can exploit this by embedding malicious code in model files, which is executed upon loading. This issue is fixed in version 5.4.3rc2.",
"severity": [
{
"type": "CVSS_V3",
@@ -28,7 +28,7 @@
"introduced": "5.3.1"
},
{
"fixed": "5.4.3rc1"
"fixed": "5.4.3rc2"
}
]
}
@@ -40,6 +40,10 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12029"
},
{
"type": "WEB",
"url": "https://github.com/invoke-ai/InvokeAI/commit/ed46acee79460189b38c164321b14bdfbf3073c9"
},
{
"type": "WEB",
"url": "https://github.com/invoke-ai/invokeai/commit/756008dc5899081c5aa51e5bd8f24c1b3975a59e"