CVE-2024-32027
Published: 16 April 2024
Summary
CVE-2024-32027 is a critical-severity Command Injection (CWE-77) vulnerability in Bmaltais Kohya Ss. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 11.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as Computer Vision; in the Other ATLAS/OWASP Terms risk domain; MITRE ATLAS techniques in scope: AI Supply Chain Compromise (AML.T0010), Exfiltration via AI Inference API (AML.T0024), External Harms (AML.T0048).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-29865
Vulnerability details
Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss v22.6.1 is vulnerable to command injection in `finetune_gui.py` This vulnerability is fixed in 23.1.5.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Computer Vision
- Risk Domain
- Other ATLAS/OWASP Terms
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Kohya_ss is a GUI tool for Kohya's Stable Diffusion trainers, where Stable Diffusion is a deep learning model for image generation, directly related to computer vision tasks.
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in finetune_gui.py enables arbitrary Unix shell command execution (T1059.004) via unsanitized user input in a Gradio web GUI, exploitable as a public-facing application vulnerability (T1190).
MITRE ATLAS TechniquesAI
MITRE ATLAS techniques
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.