{"data":{"id":"5711ffa8-1d0d-400a-9987-0aa3669ec8e1","title":"CVE-2024-12029: A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the…","summary":"CVE-2024-12029 is a remote code execution vulnerability in invoke-ai/invokeai versions 5.3.1 through 5.4.2, reached via the /api/v2/models/install API. The flaw is unsafe deserialization of model files with torch.load without proper validation (CWE-502), so an attacker who embeds malicious code in a model file gets it executed when the file is loaded.","solution":"This issue is fixed in version 5.4.3.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-12029","publishedAt":"2025-03-20T10:15:26.157Z","cveId":"CVE-2024-12029","cweIds":["CWE-502"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["InvokeAI@>= 5.3.1, < 5.4.3rc2 (fixed: 5.4.3rc2)"],"affectedPackageNames":["invokeai"],"affectedPackageRefs":["pypi:invokeai"],"affectedVendors":[],"affectedVendorsRaw":["InvokeAI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"invoke-ai/invokeai remote code execution through /api/v2/models/install","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.05983,"epssCheckedAt":"2026-11-04T06:10:14.970Z","kevDateAdded":null,"advisoryAliases":["GHSA-mcrp-whpw-jp68"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:54:26.089Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-12-03T00:13:02.711Z","daysToFix":-107,"fixCheckedAt":"2026-10-29T21:45:01.901Z","capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability","safety"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[{"ecosystem":"pypi","name":"InvokeAI","fixedVersion":"5.4.3rc2","matchedVersion":"5.4.3rc2","fixReleasedAt":"2024-12-03T00:13:02.711Z","daysToFix":-107,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:45:01.750Z"}]}}