GHSA-ffh5-w482-c7m5

InvokeAI Uncontrolled Resource Consumption vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-11043

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	InvokeAI	<= 5.0.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A Denial of Service (DoS) vulnerability was discovered in the /api/v1/boards/{board_id} endpoint of invoke-ai/invokeai version v5.0.2. This vulnerability occurs when an excessively large payload is sent in the board_name field during a PATCH request. By sending a large payload, the UI becomes unresponsive, rendering it impossible for users to interact with or manage the affected board. Additionally, the option to delete the board becomes inaccessible, amplifying the severity of the issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-11043 advisory
https://github.com/invoke-ai/InvokeAI package
https://github.com/invoke-ai/InvokeAI/blob/b79f2a4e4f183db9016584813748a69d34d62a26/invokeai/app/services/shared/invocation_context.py#L76 web
https://huntr.com/bounties/9270900a-b8b7-402f-aee5-432d891e5648 web