Kohya_ss — Command Injection (CVE-2024-32022)
Date: 2024-04
Affected: bmaltais/kohya_ss
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2024-32022
CVE-2024-32023
CVE-2024-32024
CVE-2024-32025
CVE-2024-32026
CVE-2024-32027
CWE: CWE-22
CWE-77
CVSS: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to command injection in basic_caption_gui.py. This vulnerability is fixed in 23.1.5.


Mitigations:

Architectural layers (MAESTRO):