Live › vulnerability › CVE-2024-11042
Go to dashboardInvokeAI, an open-source image generation tool, exposes a web API endpoint (POST /api/v1/images/delete) that does not restrict which file paths it removes. An unauthenticated attacker can delete arbitrary files on the server, such as SSH keys, SQLite databases and configuration files.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:51 UTC, 0h before NVD. All times on this page are UTC.
Any InvokeAI instance before 5.3.0rc1 whose web interface or API is reachable by an attacker. Instances bound only to localhost or behind a network that blocks outside access are less exposed. The sources do not say whether authentication changes the outcome, so treat exposed instances as at risk.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| InvokeAI | pypi | < 5.3.0rc1 | 5.3.0rc1 |
pip show InvokeAI and confirm whether it is below 5.3.0rc1InvokeAI PyPI package to 5.3.0rc1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In invoke-ai/invokeai version v5.0.2, the web API POST /api/v1/images/delete is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized attackers to delete arbitrary files on the server, potentially including critical or sensitive system files such as SSH keys, SQLite databases, and configuration files. This can impact the integrity and availability of applications relying on these files.
This page as .md · .json · in your agent: get_signal("CVE-2024-11042")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.