PyPI/invokeai CVE-2024-12029: unknown, EPSS 5.98%
A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files
Action: Upgrade invokeai to 5.4.3rc1 or later.
pip install invokeai==5.4.3rc1Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.3.1 | 5.4.3rc1 | - |
Fixed versions
| 5.4.3rc1 |
Sources
- osv: PYSEC-2025-9
- https://github.com/invoke-ai/invokeai/commit/756008dc5899081c5aa51e5bd8f24c1b3975a59e
- https://huntr.com/bounties/9b790f94-1b1b-4071-bc27-78445d1a87a3
- https://github.com/advisories/GHSA-mcrp-whpw-jp68
CVE-2024-12029 · published · modified · JSON