CVE-2024-32026: Insufficient Information (NVD-CWE-noinfo)
value: Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to a command injection in `git_caption_gui.py`. This vulnerability is fixed in 23.1.5.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-16T15:15Z
Repository: https://github.com/bmaltais/kohya_ss
Language: Python
Files changed: README.md, _typos.toml, kohya_gui/basic_caption_gui.py, kohya_gui/blip_caption_gui.py, kohya_gui/class_command_executor.py, kohya_gui/convert_lcm_gui.py, kohya_gui/convert_model_gui.py, kohya_gui/extract_lora_from_dylora_gui.py, kohya_gui/extract_lora_gui.py, kohya_gui/extract_lycoris_locon_gui.py, kohya_gui/finetune_gui.py, kohya_gui/git_caption_gui.py, kohya_gui/group_images_gui.py, kohya_gui/merge_lora_gui.py, kohya_gui/merge_lycoris_gui.py, kohya_gui/resize_lora_gui.py, kohya_gui/svd_merge_lora_gui.py, kohya_gui/wd14_caption_gui.py
Commit date: 2024-04-11 08:00:31 -0400
Commit message: Remove shell=True from scripts (#2257)

* Remove shell=True from scripts
Diff: diff --git a/README.md b/README.md
index c45a2ce2..55359a2d 100644
--- a/README.md
+++ b/README.md
@@ -409,13 +409,14 @@ ControlNet dataset is used to specify the mask. The mask images should be the RG
 ## Change History
 
 ### 2024/04/10 (v23.1.5)
 
 - Fix issue with Textual Inversion configuration file selection.
-- Upgrade to gradio 4.19.2 to fix several high security risks associated to earlier versions. Hoping this will not introduce undorseen issues.
+- Upgrade to gradio 4.19.2 to fix several high security risks associated to earlier versions. This is a major upgrade, moving from 3.x to 4.x. Hoping this will not introduce undorseen issues.
 - Upgrade transformers to 4.38.0 to fix a low severity security issue.
 - Add explicit --do_not_share parameter to kohya_gui.py to avoid sharing the GUI on platforms like Kaggle.
+- Remove shell=True from subprocess calls to avoid security issues when using the GUI.
 
 ### 2024/04/08 (v23.1.4)
 
 - Relocate config accordion to the top of the GUI.
 
diff --git a/_typos.toml b/_typos.toml
index ae9e06b1..d73875a9 100644
--- a/_typos.toml
+++ b/_typos.toml
@@ -25,9 +25,10 @@ ori="ori"
 hru="hru"
 rik="rik"
 koo="koo"
 yos="yos"
 wn="wn"
+parm = "parm"
 
 
 [files]
 extend-exclude = ["_typos.toml", "venv"]
diff --git a/kohya_gui/basic_caption_gui.py b/kohya_gui/basic_caption_gui.py
index ed8d46d2..4866a3f5 100644
--- a/kohya_gui/basic_caption_gui.py
+++ b/kohya_gui/basic_caption_gui.py
@@ -81,11 +81,11 @@ def caption_images(
         env["PYTHONPATH"] = (
             rf"{scriptdir}{os.pathsep}{scriptdir}/tools{os.pathsep}{env.get('PYTHONPATH', '')}"
         )
 
         # Run the command based on the operating system
-        subprocess.run(run_cmd, shell=True, env=env)
+        subprocess.run(run_cmd, env=env)
 
     # Check if overwrite option is enabled
     if overwrite:
         # Add prefix and postfix to caption files
         if prefix or postfix:
diff --git a/kohya_gui/blip_caption_gui.py b/kohya_gui/blip_caption_gui.py
index dab98454..cda0b288 100644
--- a/kohya_gui/blip_caption_gui.py
+++ b/kohya_gui/blip_caption_gui.py
@@ -77,11 +77,11 @@ def caption_images(
     env["PYTHONPATH"] = (
         f"{scriptdir}{os.pathsep}{scriptdir}/sd-scripts{os.pathsep}{env.get('PYTHONPATH', '')}"
     )
 
     # Run the command in the sd-scripts folder context
-    subprocess.run(run_cmd, shell=True, env=env, cwd=f"{scriptdir}/sd-scripts")
+    subprocess.run(run_cmd, env=env, cwd=f"{scriptdir}/sd-scripts")
 
     # Add prefix and postfix
     add_pre_postfix(
         folder=train_data_dir,
         caption_file_ext=caption_file_ext,
diff --git a/kohya_gui/class_command_executor.py b/kohya_gui/class_command_executor.py
index ccd15a71..c9530cd6 100644
--- a/kohya_gui/class_command_executor.py
+++ b/kohya_gui/class_command_executor.py
@@ -26,11 +26,11 @@ class CommandExecutor:
         - **kwargs: Additional keyword arguments to pass to subprocess.Popen.
         """
         if self.process and self.process.poll() is None:
             log.info("The command is already running. Please wait for it to finish.")
         else:
-            self.process = subprocess.Popen(run_cmd, shell=True, **kwargs)
+            self.process = subprocess.Popen(run_cmd, **kwargs)
 
     def kill_command(self):
         """
         Kill the currently running command and its child processes.
         """
diff --git a/kohya_gui/convert_lcm_gui.py b/kohya_gui/convert_lcm_gui.py
index dbc928e4..c087eece 100644
--- a/kohya_gui/convert_lcm_gui.py
+++ b/kohya_gui/convert_lcm_gui.py
@@ -57,11 +57,11 @@ def convert_lcm(name, model_path, lora_scale, model_type):
     env["PYTHONPATH"] = (
         rf"{scriptdir}{os.pathsep}{scriptdir}/sd-scripts{os.pathsep}{env.get('PYTHONPATH', '')}"
     )
 
     # Run the command
-    subprocess.run(run_cmd, shell=True, env=env)
+    subprocess.run(run_cmd, env=env)
 
     # Return a success message
     log.info("Done extracting...")
 
 
diff --git a/kohya_gui/convert_model_gui.py b/kohya_gui/convert_model_gui.py
index f8fec747..aedda3c5 100644
--- a/kohya_gui/convert_model_gui.py
+++ b/kohya_gui/convert_model_gui.py
@@ -102,11 +102,11 @@ def convert_model(
     env["PYTHONPATH"] = (
         rf"{scriptdir}{os.pathsep}{scriptdir}/sd-scripts{os.pathsep}{env.get('PYTHONPATH', '')}"
     )
 
     # Run the command
-    subprocess.run(run_cmd, shell=True, env=env)
+    subprocess.run(run_cmd, env=env)
 
 
 ###
 # Gradio UI
 ###
diff --git a/kohya_gui/extract_lora_from_dylora_gui.py b/kohya_gui/extract_lora_from_dylora_gui.py
index d99a1523..9f55b667 100644
--- a/kohya_gui/extract_lora_from_dylora_gui.py
+++ b/kohya_gui/extract_lora_from_dylora_gui.py
@@ -62,11 +62,11 @@ def extract_dylora(
     env["PYTHONPATH"] = (
         rf"{scriptdir}{os.pathsep}{scriptdir}/sd-scripts{os.pathsep}{env.get('PYTHONPATH', '')}"
     )
 
     # Run the command
-    subprocess.run(run_cmd, shell=True, env=env)
+    subprocess.run(run_cmd, env=env)
 
     log.info("Done extracting DyLoRA...")
 
 
 ###
diff --git a/kohya_gui/extract_lora_gui.py b/kohya_gui/extract_lora_gui.py
index 66c1e612..4ef01904 100644
--- a/kohya_gui/extract_lora_gui.py
+++ b/kohya_gui/extract_lora_gui.py
@@ -100,11 +100,11 @@ def extract_lora(
     env["PYTHONPATH"] = (
         rf"{scriptdir}{os.pathsep}{scriptdir}/sd-scripts{os.pathsep}{env.get('PYTHONPATH', '')}"
     )
 
     # Run the command
-    subprocess.run(run_cmd, shell=True, env=env)
+    subprocess.run(run_cmd, env=env)
 
 
 ###
 # Gradio UI
 ###
diff --git a/kohya_gui/extract_lycoris_locon_gui.py b/kohya_gui/extract_lycoris_locon_gui.py
index 4ae33157..1da7010b 100644
--- a/kohya_gui/extract_lycoris_locon_gui.py
+++ b/kohya_gui/extract_lycoris_locon_gui.py
@@ -108,11 +108,11 @@ def extract_lycoris_locon(
     env["PYTHONPATH"] = (
         rf"{scriptdir}{os.pathsep}{scriptdir}/sd-scripts{os.pathsep}{env.get('PYTHONPATH', '')}"
     )
 
     # Run the command
-    subprocess.run(run_cmd, shell=True, env=env)
+    subprocess.run(run_cmd, env=env)
 
     log.info("Done extracting...")
 
 
 ###
diff --git a/kohya_gui/finetune_gui.py b/kohya_gui/finetune_gui.py
index cc4b2850..69cf30a5 100644
--- a/kohya_gui/finetune_gui.py
+++ b/kohya_gui/finetune_gui.py
@@ -515,14 +515,15 @@ def train_model(
 
             env = os.environ.copy()
             env["PYTHONPATH"] = (
                 rf"{scriptdir}{os.pathsep}{scriptdir}/sd-scripts{os.pathsep}{env.get('PYTHONPATH', '')}"
             )
+            env["TF_ENABLE_ONEDNN_OPTS"] = "0"
 
             if not print_only:
                 # Run the command
-                subprocess.run(run_cmd, shell=True, env=env)
+                subprocess.run(run_cmd, env=env)
 
         # create images buckets
         if generate_image_buckets:
             run_cmd = rf'"{PYTHON}" "{scriptdir}/sd-scripts/finetune/prepare_buckets_latents.py"'
             run_cmd += rf' "{image_folder}"'
@@ -548,14 +549,15 @@ def train_model(
 
             env = os.environ.copy()
             env["PYTHONPATH"] = (
                 rf"{scriptdir}{os.pathsep}{scriptdir}/sd-scripts{os.pathsep}{env.get('PYTHONPATH', '')}"
             )
+            env["TF_ENABLE_ONEDNN_OPTS"] = "0"
 
             if not print_only:
                 # Run the command
-                subprocess.run(run_cmd, shell=True, env=env)
+                subprocess.run(run_cmd, env=env)
 
         image_num = len(
             [
                 f
                 for f, lower_f in (
diff --git a/kohya_gui/git_caption_gui.py b/kohya_gui/git_caption_gui.py
index a9844974..f0b07def 100644
--- a/kohya_gui/git_caption_gui.py
+++ b/kohya_gui/git_caption_gui.py
@@ -49,11 +49,11 @@ def caption_images(
     env["PYTHONPATH"] = (
         rf"{scriptdir}{os.pathsep}{scriptdir}/sd-scripts{os.pathsep}{env.get('PYTHONPATH', '')}"
     )
 
     # Run the command
-    subprocess.run(run_cmd, shell=True, env=env)
+    subprocess.run(run_cmd, env=env)
 
     # Add prefix and postfix
     add_pre_postfix(
         folder=train_data_dir,
         caption_file_ext=caption_ext,
diff --git a/kohya_gui/group_images_gui.py b/kohya_gui/group_images_gui.py
index 55552e30..914aad25 100644
--- a/kohya_gui/group_images_gui.py
+++ b/kohya_gui/group_images_gui.py
@@ -51,11 +51,11 @@ def group_images(
     env["PYTHONPATH"] = (
         rf"{scriptdir}{os.pathsep}{scriptdir}/sd-scripts{os.pathsep}{env.get('PYTHONPATH', '')}"
     )
 
     # Run the command
-    subprocess.run(run_cmd, shell=True, env=env)
+    subprocess.run(run_cmd, env=env)
 
     log.info("...grouping done")
 
 
 def gradio_group_images_gui_tab(headless=False):
diff --git a/kohya_gui/merge_lora_gui.py b/kohya_gui/merge_lora_gui.py
index 662cd55f..75f638d3 100644
--- a/kohya_gui/merge_lora_gui.py
+++ b/kohya_gui/merge_lora_gui.py
@@ -450,8 +450,8 @@ class GradioMergeLoRaTab:
         env["PYTHONPATH"] = (
             rf"{scriptdir}{os.pathsep}{scriptdir}/sd-scripts{os.pathsep}{env.get('PYTHONPATH', '')}"
         )
 
         # Run the command
-        subprocess.run(run_cmd, shell=True, env=env)
+        subprocess.run(run_cmd, env=env)
 
         log.info("Done merging...")
diff --git a/kohya_gui/merge_lycoris_gui.py b/kohya_gui/merge_lycoris_gui.py
index bb6ae9ee..3ddbc711 100644
--- a/kohya_gui/merge_lycoris_gui.py
+++ b/kohya_gui/merge_lycoris_gui.py
@@ -54,11 +54,11 @@ def merge_lycoris(
     env["PYTHONPATH"] = (
         rf"{scriptdir}{os.pathsep}{scriptdir}/sd-scripts{os.pathsep}{env.get('PYTHONPATH', '')}"
     )
 
     # Run the command
-    subprocess.run(run_cmd, shell=True, env=env)
+    subprocess.run(run_cmd, env=env)
 
     log.info("Done merging...")
 
 
 ###
diff --git a/kohya_gui/resize_lora_gui.py b/kohya_gui/resize_lora_gui.py
index 21b3ea53..9253c0a9 100644
--- a/kohya_gui/resize_lora_gui.py
+++ b/kohya_gui/resize_lora_gui.py
@@ -81,11 +81,11 @@ def resize_lora(
     env["PYTHONPATH"] = (
         rf"{scriptdir}{os.pathsep}{scriptdir}/sd-scripts{os.pathsep}{env.get('PYTHONPATH', '')}"
     )
 
     # Run the command
-    subprocess.run(run_cmd, shell=True, env=env)
+    subprocess.run(run_cmd, env=env)
 
     log.info("Done resizing...")
 
 
 ###
diff --git a/kohya_gui/svd_merge_lora_gui.py b/kohya_gui/svd_merge_lora_gui.py
index c14c9c6a..ebb4f085 100644
--- a/kohya_gui/svd_merge_lora_gui.py
+++ b/kohya_gui/svd_merge_lora_gui.py
@@ -97,11 +97,11 @@ def svd_merge_lora(
     env["PYTHONPATH"] = (
         rf"{scriptdir}{os.pathsep}{scriptdir}/sd-scripts{os.pathsep}{env.get('PYTHONPATH', '')}"
     )
 
     # Run the command
-    subprocess.run(run_cmd, shell=True, env=env)
+    subprocess.run(run_cmd, env=env)
 
 
 ###
 # Gradio UI
 ###
diff --git a/kohya_gui/wd14_caption_gui.py b/kohya_gui/wd14_caption_gui.py
index 8f97f02f..9768d315 100644
--- a/kohya_gui/wd14_caption_gui.py
+++ b/kohya_gui/wd14_caption_gui.py
@@ -92,11 +92,11 @@ def caption_images(
         rf"{scriptdir}{os.pathsep}{scriptdir}/sd-scripts{os.pathsep}{env.get('PYTHONPATH', '')}"
     )
     env["TF_ENABLE_ONEDNN_OPTS"] = "0"
 
     # Run the command
-    subprocess.run(run_cmd, shell=True, env=env)
+    subprocess.run(run_cmd, env=env)
     
     # Add prefix and postfix
     add_pre_postfix(
         folder=train_data_dir,
         caption_file_ext=caption_extension,

Vulnerable code: - Upgrade to gradio 4.19.2 to fix several high security risks associated to earlier versions. Hoping this will not introduce undorseen issues.
        subprocess.run(run_cmd, shell=True, env=env)
    subprocess.run(run_cmd, shell=True, env=env, cwd=f"{scriptdir}/sd-scripts")
            self.process = subprocess.Popen(run_cmd, shell=True, **kwargs)
    subprocess.run(run_cmd, shell=True, env=env)
    subprocess.run(run_cmd, shell=True, env=env)
    subprocess.run(run_cmd, shell=True, env=env)
    subprocess.run(run_cmd, shell=True, env=env)
    subprocess.run(run_cmd, shell=True, env=env)
                subprocess.run(run_cmd, shell=True, env=env)
                subprocess.run(run_cmd, shell=True, env=env)
    subprocess.run(run_cmd, shell=True, env=env)
    subprocess.run(run_cmd, shell=True, env=env)
        subprocess.run(run_cmd, shell=True, env=env)
    subprocess.run(run_cmd, shell=True, env=env)
    subprocess.run(run_cmd, shell=True, env=env)
    subprocess.run(run_cmd, shell=True, env=env)
    subprocess.run(run_cmd, shell=True, env=env)
Fixed code: - Upgrade to gradio 4.19.2 to fix several high security risks associated to earlier versions. This is a major upgrade, moving from 3.x to 4.x. Hoping this will not introduce undorseen issues.
- Remove shell=True from subprocess calls to avoid security issues when using the GUI.
parm = "parm"
        subprocess.run(run_cmd, env=env)
    subprocess.run(run_cmd, env=env, cwd=f"{scriptdir}/sd-scripts")
            self.process = subprocess.Popen(run_cmd, **kwargs)
    subprocess.run(run_cmd, env=env)
    subprocess.run(run_cmd, env=env)
    subprocess.run(run_cmd, env=env)
    subprocess.run(run_cmd, env=env)
    subprocess.run(run_cmd, env=env)
            env["TF_ENABLE_ONEDNN_OPTS"] = "0"
                subprocess.run(run_cmd, env=env)
            env["TF_ENABLE_ONEDNN_OPTS"] = "0"
                subprocess.run(run_cmd, env=env)
    subprocess.run(run_cmd, env=env)
    subprocess.run(run_cmd, env=env)
        subprocess.run(run_cmd, env=env)
    subprocess.run(run_cmd, env=env)
    subprocess.run(run_cmd, env=env)
    subprocess.run(run_cmd, env=env)
    subprocess.run(run_cmd, env=env)