PyPI/invokeai CVE-2024-12029: critical 9.8, EPSS 5.98%

InvokeAI Deserialization of Untrusted Data vulnerability

Action: Upgrade invokeai to 5.4.3rc2 or later.

pip install invokeai==5.4.3rc2

Affected

Fixed versions

Sources

• osv: GHSA-mcrp-whpw-jp68
• https://nvd.nist.gov/vuln/detail/CVE-2024-12029
• https://github.com/invoke-ai/InvokeAI/commit/ed46acee79460189b38c164321b14bdfbf3073c9
• https://github.com/invoke-ai/invokeai/commit/756008dc5899081c5aa51e5bd8f24c1b3975a59e
• https://github.com/invoke-ai/InvokeAI
• https://github.com/pypa/advisory-database/tree/main/vulns/invokeai/PYSEC-2025-9.yaml
• https://huntr.com/bounties/9b790f94-1b1b-4071-bc27-78445d1a87a3

CVE-2024-12029 · published 2025-03-21T15:32:15Z · modified 2025-05-20T18:11:03.727326Z · JSON