CVE-2024-32027 (Python, published 2024-04-16T15:15Z)
Description: value: Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss v22.6.1 is vulnerable to command injection in `finetune_gui.py` This vulnerability is fixed in 23.1.5.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/bmaltais/kohya_ss
Files changed:
README.md
_typos.toml
kohya_gui/basic_caption_gui.py
kohya_gui/blip_caption_gui.py
kohya_gui/class_command_executor.py
kohya_gui/convert_lcm_gui.py
kohya_gui/convert_model_gui.py
kohya_gui/extract_lora_from_dylora_gui.py
kohya_gui/extract_lora_gui.py
kohya_gui/extract_lycoris_locon_gui.py
kohya_gui/finetune_gui.py
kohya_gui/git_caption_gui.py
kohya_gui/group_images_gui.py
kohya_gui/merge_lora_gui.py
kohya_gui/merge_lycoris_gui.py
kohya_gui/resize_lora_gui.py
kohya_gui/svd_merge_lora_gui.py
kohya_gui/wd14_caption_gui.py
Commit message: Remove shell=True from scripts (#2257)

* Remove shell=True from scripts

Vulnerable code:
- Upgrade to gradio 4.19.2 to fix several high security risks associated to earlier versions. Hoping this will not introduce undorseen issues.
        subprocess.run(run_cmd, shell=True, env=env)
    subprocess.run(run_cmd, shell=True, env=env, cwd=f"{scriptdir}/sd-scripts")
            self.process = subprocess.Popen(run_cmd, shell=True, **kwargs)
    subprocess.run(run_cmd, shell=True, env=env)
    subprocess.run(run_cmd, shell=True, env=env)
    subprocess.run(run_cmd, shell=True, env=env)
    subprocess.run(run_cmd, shell=True, env=env)
    subprocess.run(run_cmd, shell=True, env=env)
                subprocess.run(run_cmd, shell=True, env=env)
                subprocess.run(run_cmd, shell=True, env=env)
    subprocess.run(run_cmd, shell=True, env=env)
    subprocess.run(run_cmd, shell=True, env=env)
        subprocess.run(run_cmd, shell=True, env=env)
    subprocess.run(run_cmd, shell=True, env=env)
    subprocess.run(run_cmd, shell=True, env=env)
    subprocess.run(run_cmd, shell=True, env=env)
    subprocess.run(run_cmd, shell=True, env=env)

Fixed code:
- Upgrade to gradio 4.19.2 to fix several high security risks associated to earlier versions. This is a major upgrade, moving from 3.x to 4.x. Hoping this will not introduce undorseen issues.
- Remove shell=True from subprocess calls to avoid security issues when using the GUI.
parm = "parm"
        subprocess.run(run_cmd, env=env)
    subprocess.run(run_cmd, env=env, cwd=f"{scriptdir}/sd-scripts")
            self.process = subprocess.Popen(run_cmd, **kwargs)
    subprocess.run(run_cmd, env=env)
    subprocess.run(run_cmd, env=env)
    subprocess.run(run_cmd, env=env)
    subprocess.run(run_cmd, env=env)
    subprocess.run(run_cmd, env=env)
            env["TF_ENABLE_ONEDNN_OPTS"] = "0"
                subprocess.run(run_cmd, env=env)
            env["TF_ENABLE_ONEDNN_OPTS"] = "0"
                subprocess.run(run_cmd, env=env)
    subprocess.run(run_cmd, env=env)
    subprocess.run(run_cmd, env=env)
        subprocess.run(run_cmd, env=env)
    subprocess.run(run_cmd, env=env)
    subprocess.run(run_cmd, env=env)
    subprocess.run(run_cmd, env=env)
    subprocess.run(run_cmd, env=env)