PT-2024-24365 · Kohya Ss · Kohya Ss

Sylwia-Budzynska · Published 2024-04-16 · Updated 2025-09-08 · CVE-2024-32027

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kohya ss versions 22.6.1 through 23.1.4

Description Kohya ss is a GUI for Kohya's Stable Diffusion trainers. The issue is related to command injection in the finetune gui.py file. This vulnerability is fixed in version 23.1.5.

Recommendations For versions 22.6.1 through 23.1.4, update to version 23.1.5 to resolve the issue. As a temporary workaround, consider restricting access to the finetune gui.py file until the update is applied.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-32027

GHSA-8H78-3VQM-XW83

Affected Products

Kohya Ss

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32027.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2024-019_GHSL-2024-024_kohya_ss · Exploit
• https://github.com/bmaltais/kohya_ss/commit/831af8babeb75faff62bcc6a8c6a4f80354f1ff1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-32027 · Security Note
• https://osv.dev/vulnerability/CVE-2024-32027 · Vendor Advisory
• https://github.com/bmaltais/kohya_ss/security/advisories/GHSA-8h78-3vqm-xw83 · Note
• https://t.me/cvenotify/77078 · Telegram Post
• https://twitter.com/cracbot/status/1780495198578958713 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1780275710399025160 · Twitter Post
• https://t.me/cvenotify/77460 · Telegram Post
• https://t.me/cveNotify/134680 · Telegram Post