Skip to content
OpenAdvisories

Package · PyPI

invokeai

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2025-6237

    Path Traversal and Arbitrary File Deletion in invoke-ai/invokeai

    A vulnerability in invokeai version v6.0.0a1 and below allows attackers to perform path traversal and arbitrary file deletion via the GET /api/v1/images/download/{bulk_download_item_name} endpoint. By manipulating the filename arguments, attackers can read an…

    invoke-ai invoke-ai/invokeai invokeai PyPI
  • Critical 9.1
    CVE-2024-11042 Public exploit

    Arbitrary File Delete in invoke-ai/invokeai

    In invoke-ai/invokeai version v5.0.2, the web API `POST /api/v1/images/delete` is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized attackers to delete arbitrary files on the server, potentially including critical or sensitive syst…

    invoke-ai invoke-ai/invokeai invokeai PyPI
  • Critical 9.8
    CVE-2024-12029 Public exploit

    Remote Code Execution via Model Deserialization in invoke-ai/invokeai

    A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can e…

    invoke-ai invoke-ai/invokeai invokeai PyPI