CVE-2024-32025
Published: 16 April 2024
Summary
CVE-2024-32025 is a critical-severity Command Injection (CWE-77) vulnerability in Bmaltais Kohya Ss. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 11.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as Computer Vision; in the Other ATLAS/OWASP Terms risk domain; MITRE ATLAS techniques in scope: AI Supply Chain Compromise (AML.T0010), Obtain Capabilities (AML.T0016), Exfiltration via AI Inference API (AML.T0024).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-29863
Vulnerability details
Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to a command injection in `group_images_gui.py`. This vulnerability is fixed in 23.1.5.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Computer Vision
- Risk Domain
- Other ATLAS/OWASP Terms
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Kohya_ss is a GUI for Stable Diffusion trainers, which are used for training image generation models (diffusion models) in the computer vision domain.
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in group_images_gui.py allows arbitrary shell command execution via unsanitized inputs (e.g., input_folder, output_folder, group_size) passed to os.system/subprocess.run, enabling T1059 (Command and Scripting Interpreter) and exploited via T1203 (Exploitation for Client Execution) in the Gradio-based GUI application.
MITRE ATLAS TechniquesAI
MITRE ATLAS techniques
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.