Vulnerability Instance

HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/vulnerabilities/36999?format=api",
    "vulnerability_id": "VCID-uzyp-pdaw-q7d9",
    "summary": "A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can exploit this by embedding malicious code in model files, which is executed upon loading. This issue is fixed in version 5.4.3.",
    "aliases": [
        {
            "alias": "CVE-2024-12029"
        },
        {
            "alias": "PYSEC-2025-9"
        }
    ],
    "fixed_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/44642?format=api",
            "purl": "pkg:pypi/invokeai@5.4.3rc1",
            "is_vulnerable": false,
            "affected_by_vulnerabilities": [],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/invokeai@5.4.3rc1"
        }
    ],
    "affected_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/44635?format=api",
            "purl": "pkg:pypi/invokeai@5.3.1",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-uzyp-pdaw-q7d9"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/invokeai@5.3.1"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/44636?format=api",
            "purl": "pkg:pypi/invokeai@5.4.0",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-uzyp-pdaw-q7d9"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/invokeai@5.4.0"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/44637?format=api",
            "purl": "pkg:pypi/invokeai@5.4.1rc1",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-uzyp-pdaw-q7d9"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/invokeai@5.4.1rc1"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/44638?format=api",
            "purl": "pkg:pypi/invokeai@5.4.1rc2",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-uzyp-pdaw-q7d9"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/invokeai@5.4.1rc2"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/44639?format=api",
            "purl": "pkg:pypi/invokeai@5.4.1",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-uzyp-pdaw-q7d9"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/invokeai@5.4.1"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/44640?format=api",
            "purl": "pkg:pypi/invokeai@5.4.2rc1",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-uzyp-pdaw-q7d9"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/invokeai@5.4.2rc1"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/44641?format=api",
            "purl": "pkg:pypi/invokeai@5.4.2",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-uzyp-pdaw-q7d9"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/invokeai@5.4.2"
        }
    ],
    "references": [
        {
            "reference_url": "https://github.com/invoke-ai/invokeai/commit/756008dc5899081c5aa51e5bd8f24c1b3975a59e",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/invoke-ai/invokeai/commit/756008dc5899081c5aa51e5bd8f24c1b3975a59e"
        },
        {
            "reference_url": "https://huntr.com/bounties/9b790f94-1b1b-4071-bc27-78445d1a87a3",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://huntr.com/bounties/9b790f94-1b1b-4071-bc27-78445d1a87a3"
        }
    ],
    "weaknesses": [],
    "exploits": [],
    "severity_range_score": null,
    "exploitability": null,
    "weighted_severity": null,
    "risk_score": null,
    "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-uzyp-pdaw-q7d9"
}