CVE-2024-32022

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to command injection in basic_caption_gui.py. This vulnerability is fixed in 23.1.5.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
bmaltais	kohya_ss	>= 22.6.1, < 23.1.5
bmaltais	kohya_ss	>= 22.61, < 23.1.5

References

https://github.com/bmaltais/kohya_ss/commit/831af8babeb75faff62bcc6a8c6a4f80354f1ff1Patch
https://github.com/bmaltais/kohya_ss/security/advisories/GHSA-m6jq-7j4v-2fg3Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2024-019_GHSL-2024-024_kohya_ssExploit, Third Party Advisory
https://github.com/bmaltais/kohya_ss/commit/831af8babeb75faff62bcc6a8c6a4f80354f1ff1Patch
https://github.com/bmaltais/kohya_ss/security/advisories/GHSA-m6jq-7j4v-2fg3Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2024-019_GHSL-2024-024_kohya_ssExploit, Third Party Advisory

Timeline

Published: Apr 16, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-320235.3Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to a path injection in the `common_gui.py` `find_and_replace CVE-2024-320246.5Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to a path injection in the `common_gui.py` `add_pre_postfix`CVE-2024-320259.1Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to a command injection in `group_images_gui.py`. This vulner CVE-2024-320269.8Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to a command injection in `git_caption_gui.py`. This vulnera CVE-2024-320279.8Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss v22.6.1 is vulnerable to command injection in `finetune_gui.py` This vulne CVE-2024-320284.1OpenTelemetry dotnet is a dotnet telemetry framework. In affected versions of `OpenTelemetry.Instrumentation.Http` and `OpenTelemetry.Instru CVE-2024-32039.8A vulnerability, which was classified as critical, was found in c-blosc2 up to 2.13.2. Affected is the function ndlz8_decompress of the file CVE-2024-320308.1Kafka UI is an Open-Source Web UI for Apache Kafka Management. Kafka UI API allows users to connect to different Kafka brokers by specifying CVE-2024-320344.8decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The admin pan CVE-2024-320356.5ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can l CVE-2024-320366.5ImageSharp is a 2D graphics API. A data leakage flaw was found in ImageSharp's JPEG and TGA decoders. This vulnerability is triggered when a CVE-2024-320375.3GeoNetwork is a catalog application to manage spatially referenced resources. In versions prior to 4.2.10 and 4.4.5, the search end-point re