CVE-2024-12029
CRITICALCVSS v3
9.8
CRITICAL
EPSS Score
49.1%
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can exploit this by embedding malicious code in model files, which is executed upon loading. This issue is fixed in version 5.4.3.
Technical Details
- Published
- 3/20/2025
Frequently Asked Questions
What is CVE-2024-12029?
A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can exploit this by embedding malicious code in model files, which is executed upon loading. This issue is fixed in version 5.4.3.
Is CVE-2024-12029 actively exploited?
Active exploitation of CVE-2024-12029 has not been confirmed. The EPSS score is 49.1%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2024-12029?
CVE-2024-12029 has a CVSS v3 base score of 9.8 (CRITICAL severity).
Is CVE-2024-12029 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.