critical vulnerability

InvokeAI Arbitrary File Deletion vulnerability

Fix availableCritical · CVSS 9.1EPSS 1.6%

Published Mar 20, 2025 · updated Oct 27, 2026

What to do

Upgrade to a fixed version: InvokeAI 5.3.0rc1.
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIInvokeAI5,287 downloads/week

Vulnerable versions: < 5.3.0rc1
Fixed in: 5.3.0rc1

Check your project: pip show InvokeAI

Sources

GitHub Advisory GHSA-227r-w5j2-6243
NVD CVE-2024-11042

CWE-20 Improper Input Validation · CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') · CWE-73 External Control of File Name or Path

← All critical vulnerabilities