Exploit for CVE-2024-12029

Alternative-Approach-Reverse-Shell-Callback-Test-InvokeAI-RCE...

CVE-2024-12029 Remote Code Execution via Model Deserialization in invoke-ai/invokeai

A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can exploit this by embedding malicious cod...

InvokeAI Remote Code Execution Exploit

InvokeAI has a critical vulnerability leading to remote code execution in the /api/v2/models/install API through unsafe model deserialization. The API allows users to specify a model URL, which is downloaded and loaded server-side using torch.load without proper validation. This functionality...

CVE-2024-12029

creationtimestamp| type| source ---|---|--- 2025-02-18 13:08:28+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/invokeaircecve202412029.rb 2025-02-19 02:34:22+00:00| seen| MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd 2025-02-19 21:02:31+00:00| seen...