CVE-2024-11042: InvokeAI Arbitrary File Deletion vulnerability
(updated )
In invoke-ai/invokeai version v5.0.2, the web API POST /api/v1/images/delete is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized attackers to delete arbitrary files on the server, potentially including critical or sensitive system files such as SSH keys, SQLite databases, and configuration files. This can impact the integrity and availability of applications relying on these files.
References
- github.com/advisories/GHSA-227r-w5j2-6243
- github.com/invoke-ai/invokeai/commit/5440c037674882b2ab7acd59087e9bb04b49657a
- github.com/pypa/advisory-database/tree/main/vulns/invokeai/PYSEC-2026-358.yaml
- huntr.com/bounties/635535a7-c804-4789-ac3a-48d951263987
- nvd.nist.gov/vuln/detail/CVE-2024-11042
- pypi.org/project/invokeai
Code Behaviors & Features
Detect and mitigate CVE-2024-11042 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →