PT-2025-12095 · Invokeai · Invokeai

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-11043

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions invoke-ai/invokeai version v5.0.2

Description A Denial of Service (DoS) issue was discovered in the "/api/v1/boards/{board id}" endpoint. This occurs when an excessively large payload is sent in the board name field during a PATCH request, causing the UI to become unresponsive and making it impossible for users to interact with or manage the affected board. The option to delete the board also becomes inaccessible.

Recommendations For invoke-ai/invokeai version v5.0.2, consider restricting access to the "/api/v1/boards/{board id}" endpoint to prevent exploitation until a fix is available. As a temporary workaround, limit the size of the payload that can be sent in the board name field to prevent the UI from becoming unresponsive.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-11043

GHSA-FFH5-W482-C7M5

Affected Products

Invokeai

References · 6

• 🔥 https://huntr.com/bounties/9270900a-b8b7-402f-aee5-432d891e5648 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-11043 · Security Note
• https://osv.dev/vulnerability/GHSA-ffh5-w482-c7m5 · Vendor Advisory
• https://github.com/invoke-ai/InvokeAI · Note
• https://github.com/invoke-ai/InvokeAI/blob/b79f2a4e4f183db9016584813748a69d34d62a26/invokeai/app/services/shared/invocation_context.py#L76 · Note
• https://twitter.com/CVEnew/status/1902671006684316095 · Twitter Post