CVE-2024-32023

2024-04-1615:15:37

Google

osv.dev

kohya_ss

gui

path injection

vulnerability

fixed

version 23.1.5

software

7 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.1%

JSON

Kohya_ss is a GUI for Kohya’s Stable Diffusion trainers. Kohya_ss is vulnerable to a path injection in the common_gui.py find_and_replace function. This vulnerability is fixed in 23.1.5.

CPENameOperatorVersion
kohya_sseq21.1.4
kohya_sseq12
kohya_sseq21.3.6
kohya_sseq21.3.8
kohya_sseq20.3.1
kohya_sseq21.7.12
kohya_sseq21.8.3
kohya_sseq21.5.4
kohya_sseq20.6.0
kohya_sseq21.7.5

Name	Operator	Version
kohya_ss	eq	21.1.4
kohya_ss	eq	12
kohya_ss	eq	21.3.6
kohya_ss	eq	21.3.8
kohya_ss	eq	20.3.1
kohya_ss	eq	21.7.12
kohya_ss	eq	21.8.3
kohya_ss	eq	21.5.4
kohya_ss	eq	20.6.0
kohya_ss	eq	21.7.5

Rows per page:

1-10 of 1471

References

github.com/bmaltais/kohya_ss/commit/8bc67a7467f8366db1a4b9b3b14525ec763f1650

github.com/bmaltais/kohya_ss/security/advisories/GHSA-p945-7qm7-7j53

securitylab.github.com/advisories/GHSL-2024-019_GHSL-2024-024_kohya_ss