What’s Vulnerable › Vulnerabilities

CVE-2024-12029: Remote Code Execution via Model Deserialization in invoke-ai/invokeai

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-20 · updated 2026-06-17
• Weakness: CWE-502

Description

A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can exploit this by embedding malicious code in model files, which is executed upon loading. This issue is fixed in version 5.4.3.

Affected products

• invoke-ai/invokeai: before 5.4.3 — fixed in 5.4.3

How to fix

Upgrade to a fixed version: invoke-ai/invokeai 5.4.3. Check the vendor advisory for mitigations.

References

• https://github.com/invoke-ai/invokeai/commit/756008dc5899081c5aa51e5bd8f24c1b3975a59e
• https://huntr.com/bounties/9b790f94-1b1b-4071-bc27-78445d1a87a3
• https://huntr.com/bounties/9b790f94-1b1b-4071-bc27-78445d1a87a3

Get alerted when CVE-2024-12029 or the next vulnerability affects your stack