CVE-2024-32026 (published 2024-04-16T15:15Z)

Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to a command injection in `git_caption_gui.py`. This vulnerability is fixed in 23.1.5.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/bmaltais/kohya_ss
commit_details: repo_url: https://github.com/bmaltais/kohya_ss
author: bmaltais
author_date: 2024-04-11 08:00:31-04:00
msg: Remove shell=True from scripts (#2257)

* Remove shell=True from scripts
repository: repo_url: https://github.com/bmaltais/kohya_ss
repo_name: bmaltais/kohya_ss
repo_language: Python
owner: bmaltais
file_changes: filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -411,9 +411,10 @@ ControlNet dataset is used to specify the mask. The mask images should be the RG
 ### 2024/04/10 (v23.1.5)
 
 - Fix issue with Textual Inversion configuration file selection.
-- Upgrade to gradio 4.19.2 to fix several high security risks associated to earlier versions. Hoping this will not introduce undorseen issues.
+- Upgrade to gradio 4.19.2 to fix several high security risks associated to earlier versions. This is a major upgrade, moving from 3.x to 4.x. Hoping this will not introduce undorseen issues.
 - Upgrade transformers to 4.38.0 to fix a low severity security issue.
 - Add explicit --do_not_share parameter to kohya_gui.py to avoid sharing the GUI on platforms like Kaggle.
+- Remove shell=True from subprocess calls to avoid security issues when using the GUI.
 
 ### 2024/04/08 (v23.1.4)
 

programming_language: Markdown
filename: _typos.toml
change_type: ModificationType.MODIFY
diff: @@ -27,6 +27,7 @@ rik="rik"
 koo="koo"
 yos="yos"
 wn="wn"
+parm = "parm"
 
 
 [files]

programming_language: Shell
filename: basic_caption_gui.py
change_type: ModificationType.MODIFY
diff: @@ -83,7 +83,7 @@ def caption_images(
         )
 
         # Run the command based on the operating system
-        subprocess.run(run_cmd, shell=True, env=env)
+        subprocess.run(run_cmd, env=env)
 
     # Check if overwrite option is enabled
     if overwrite:

programming_language: Python
filename: blip_caption_gui.py
change_type: ModificationType.MODIFY
diff: @@ -79,7 +79,7 @@ def caption_images(
     )
 
     # Run the command in the sd-scripts folder context
-    subprocess.run(run_cmd, shell=True, env=env, cwd=f"{scriptdir}/sd-scripts")
+    subprocess.run(run_cmd, env=env, cwd=f"{scriptdir}/sd-scripts")
 
     # Add prefix and postfix
     add_pre_postfix(

programming_language: Python
filename: class_command_executor.py
change_type: ModificationType.MODIFY
diff: @@ -28,7 +28,7 @@ class CommandExecutor:
         if self.process and self.process.poll() is None:
             log.info("The command is already running. Please wait for it to finish.")
         else:
-            self.process = subprocess.Popen(run_cmd, shell=True, **kwargs)
+            self.process = subprocess.Popen(run_cmd, **kwargs)
 
     def kill_command(self):
         """

programming_language: Python
filename: convert_lcm_gui.py
change_type: ModificationType.MODIFY
diff: @@ -59,7 +59,7 @@ def convert_lcm(name, model_path, lora_scale, model_type):
     )
 
     # Run the command
-    subprocess.run(run_cmd, shell=True, env=env)
+    subprocess.run(run_cmd, env=env)
 
     # Return a success message
     log.info("Done extracting...")

programming_language: Python
filename: convert_model_gui.py
change_type: ModificationType.MODIFY
diff: @@ -104,7 +104,7 @@ def convert_model(
     )
 
     # Run the command
-    subprocess.run(run_cmd, shell=True, env=env)
+    subprocess.run(run_cmd, env=env)
 
 
 ###

programming_language: Python
filename: extract_lora_from_dylora_gui.py
change_type: ModificationType.MODIFY
diff: @@ -64,7 +64,7 @@ def extract_dylora(
     )
 
     # Run the command
-    subprocess.run(run_cmd, shell=True, env=env)
+    subprocess.run(run_cmd, env=env)
 
     log.info("Done extracting DyLoRA...")
 

programming_language: Python
filename: extract_lora_gui.py
change_type: ModificationType.MODIFY
diff: @@ -102,7 +102,7 @@ def extract_lora(
     )
 
     # Run the command
-    subprocess.run(run_cmd, shell=True, env=env)
+    subprocess.run(run_cmd, env=env)
 
 
 ###

programming_language: Python
filename: extract_lycoris_locon_gui.py
change_type: ModificationType.MODIFY
diff: @@ -110,7 +110,7 @@ def extract_lycoris_locon(
     )
 
     # Run the command
-    subprocess.run(run_cmd, shell=True, env=env)
+    subprocess.run(run_cmd, env=env)
 
     log.info("Done extracting...")
 

programming_language: Python
filename: finetune_gui.py
change_type: ModificationType.MODIFY
diff: @@ -517,10 +517,11 @@ def train_model(
             env["PYTHONPATH"] = (
                 rf"{scriptdir}{os.pathsep}{scriptdir}/sd-scripts{os.pathsep}{env.get('PYTHONPATH', '')}"
             )
+            env["TF_ENABLE_ONEDNN_OPTS"] = "0"
 
             if not print_only:
                 # Run the command
-                subprocess.run(run_cmd, shell=True, env=env)
+                subprocess.run(run_cmd, env=env)
 
         # create images buckets
         if generate_image_buckets:
@@ -550,10 +551,11 @@ def train_model(
             env["PYTHONPATH"] = (
                 rf"{scriptdir}{os.pathsep}{scriptdir}/sd-scripts{os.pathsep}{env.get('PYTHONPATH', '')}"
             )
+            env["TF_ENABLE_ONEDNN_OPTS"] = "0"
 
             if not print_only:
                 # Run the command
-                subprocess.run(run_cmd, shell=True, env=env)
+                subprocess.run(run_cmd, env=env)
 
         image_num = len(
             [

programming_language: Python
filename: git_caption_gui.py
change_type: ModificationType.MODIFY
diff: @@ -51,7 +51,7 @@ def caption_images(
     )
 
     # Run the command
-    subprocess.run(run_cmd, shell=True, env=env)
+    subprocess.run(run_cmd, env=env)
 
     # Add prefix and postfix
     add_pre_postfix(

programming_language: Python
filename: group_images_gui.py
change_type: ModificationType.MODIFY
diff: @@ -53,7 +53,7 @@ def group_images(
     )
 
     # Run the command
-    subprocess.run(run_cmd, shell=True, env=env)
+    subprocess.run(run_cmd, env=env)
 
     log.info("...grouping done")
 

programming_language: Python
filename: merge_lora_gui.py
change_type: ModificationType.MODIFY
diff: @@ -452,6 +452,6 @@ class GradioMergeLoRaTab:
         )
 
         # Run the command
-        subprocess.run(run_cmd, shell=True, env=env)
+        subprocess.run(run_cmd, env=env)
 
         log.info("Done merging...")

programming_language: Python
filename: merge_lycoris_gui.py
change_type: ModificationType.MODIFY
diff: @@ -56,7 +56,7 @@ def merge_lycoris(
     )
 
     # Run the command
-    subprocess.run(run_cmd, shell=True, env=env)
+    subprocess.run(run_cmd, env=env)
 
     log.info("Done merging...")
 

programming_language: Python
filename: resize_lora_gui.py
change_type: ModificationType.MODIFY
diff: @@ -83,7 +83,7 @@ def resize_lora(
     )
 
     # Run the command
-    subprocess.run(run_cmd, shell=True, env=env)
+    subprocess.run(run_cmd, env=env)
 
     log.info("Done resizing...")
 

programming_language: Python
filename: svd_merge_lora_gui.py
change_type: ModificationType.MODIFY
diff: @@ -99,7 +99,7 @@ def svd_merge_lora(
     )
 
     # Run the command
-    subprocess.run(run_cmd, shell=True, env=env)
+    subprocess.run(run_cmd, env=env)
 
 
 ###

programming_language: Python
filename: wd14_caption_gui.py
change_type: ModificationType.MODIFY
diff: @@ -94,7 +94,7 @@ def caption_images(
     env["TF_ENABLE_ONEDNN_OPTS"] = "0"
 
     # Run the command
-    subprocess.run(run_cmd, shell=True, env=env)
+    subprocess.run(run_cmd, env=env)
     
     # Add prefix and postfix
     add_pre_postfix(

programming_language: Python