CVE-2024-12029
2 advisories.
PyPI/invokeai CVE-2024-12029: critical 9.8, EPSS 5.98%
InvokeAI Deserialization of Untrusted Data vulnerability
Action: Upgrade invokeai to 5.4.3rc2 or later.
pip install invokeai==5.4.3rc2Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.3.1 | 5.4.3rc2 | - |
Fixed versions
| 5.4.3rc2 |
Sources
- osv: GHSA-mcrp-whpw-jp68
- https://nvd.nist.gov/vuln/detail/CVE-2024-12029
- https://github.com/invoke-ai/InvokeAI/commit/ed46acee79460189b38c164321b14bdfbf3073c9
- https://github.com/invoke-ai/invokeai/commit/756008dc5899081c5aa51e5bd8f24c1b3975a59e
- https://github.com/invoke-ai/InvokeAI
- https://github.com/pypa/advisory-database/tree/main/vulns/invokeai/PYSEC-2025-9.yaml
- https://huntr.com/bounties/9b790f94-1b1b-4071-bc27-78445d1a87a3
CVE-2024-12029 · published · modified · JSON
PyPI/invokeai CVE-2024-12029: unknown, EPSS 5.98%
A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files
Action: Upgrade invokeai to 5.4.3rc1 or later.
pip install invokeai==5.4.3rc1Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.3.1 | 5.4.3rc1 | - |
Fixed versions
| 5.4.3rc1 |
Sources
- osv: PYSEC-2025-9
- https://github.com/invoke-ai/invokeai/commit/756008dc5899081c5aa51e5bd8f24c1b3975a59e
- https://huntr.com/bounties/9b790f94-1b1b-4071-bc27-78445d1a87a3
- https://github.com/advisories/GHSA-mcrp-whpw-jp68
CVE-2024-12029 · published · modified · JSON