CVE-2024-32024 (Python, published 2024-04-16T15:15Z)
Description: value: Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to a path injection in the `common_gui.py` `add_pre_postfix` function. This vulnerability is fixed in 23.1.5.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/bmaltais/kohya_ss
Files changed:
README.md
kohya_gui/common_gui.py
Commit message: Restrict extensions pre_postfix can use to improve security (#2259)



Vulnerable code:
    - [2024/03/21 (v23.0.15)](#20240321-v23015)
    - [2024/03/19 (v23.0.14)](#20240319-v23014)
    - [2024/03/19 (v23.0.13)](#20240319-v23013)
    - [2024/03/16 (v23.0.12)](#20240316-v23012)
      - [New Features \& Improvements](#new-features--improvements)
      - [Software Updates](#software-updates)
      - [Recommendations for Users](#recommendations-for-users)
    - [2024/03/13 (v23.0.11)](#20240313-v23011)

### 2024/03/21 (v23.0.15)

- Add support for toml dataset configuration fole to all trainers
- Add new setup menu option to install Triton 2.1.0 for Windows
- Add support for LyCORIS BOFT and DoRA and QLyCORIS options for LoHA, LoKr and LoCon
- Fix issue with vae path validation
- Other fixes

### 2024/03/19 (v23.0.14)

- Fix blip caption issue

### 2024/03/19 (v23.0.13)

- Fix issue with image samples.

### 2024/03/16 (v23.0.12)

#### New Features & Improvements

- **Enhanced Logging and Tracking Capabilities**
  - Added support for configuring advanced logging and tracking:
    - `wandb_run_name`: Set a custom name for your Weights & Biases runs to easily identify and organize your experiments.
    - `log_tracker_name` and `log_tracker_config`: Integrate custom logging trackers with your projects. Specify the tracker name and provide its configuration to enable detailed monitoring and logging of your runs.

- **Custom Path Defaults**
  - You can now specify custom paths more easily:
    - Simply copy the `config example.toml` file located in the root directory of the repository to `config.toml`.
    - Edit the `config.toml` file to adjust paths and settings according to your preferences.

#### Software Updates

- **sd-scripts updated to v0.8.5**
  - **Bug Fixes:**
    - Corrected an issue where the value of timestep embedding was incorrect during SDXL training. This fix ensures accurate training progress and results.
    - Addressed a related inference issue with the generation script, improving the reliability of SDXL model outputs.
  - **Note:** The exact impact of this bug is currently unknown, but it's recommended to update to v0.8.5 for anyone engaged in SDXL training to ensure optimal performance and results.

- **Upgrade of `lycoris_lora` Python Module**
  - Updated the `lycoris_lora` module to version 2.2.0.post3. This update may include bug fixes, performance improvements, and new features.

#### Recommendations for Users

- To benefit from the latest features and improvements, users are encouraged to update their installations and configurations accordingly.

### 2024/03/13 (v23.0.11)

- Increase icon size.
- More setup fixes.

Fixed code:
      - [Security Improvements](#security-improvements)

#### Security Improvements

- Limit caption extensions to a fixed set of extensions to limit the risk of finding and replacing text content in unexpected files.
    # Enforce that the provided extension is one of .caption, .cap, .txt
    if caption_file_ext not in (".caption", ".cap", ".txt"):
        log.error("Invalid caption file extension. Must be on of .caption, .cap, .txt")
        return