Detections
Analytics

SCA: security update for InvokeAI (GHSA-227r-w5j2-6243)

critical Tenable Self-Hosted Container Security Plugin ID 421186

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In invoke-ai/invokeai version v5.0.2, the web API `POST /api/v1/images/delete` is vulnerable to Arbitrary
 File Deletion. This vulnerability allows unauthorized attackers to delete arbitrary files on the server,
 potentially including critical or sensitive system files such as SSH keys, SQLite databases, and
 configuration files. This can impact the integrity and availability of applications relying on these
 files. (CVE-2024-11042)

See Also

https://github.com/advisories/GHSA-227r-w5j2-6243

Plugin Details

Severity: Critical

ID: 421186

Version: Revision 1.11

Type: Local

Family: SCA Checks

Published: 3/21/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.2

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:C

CVSS Score Source: CVE-2024-11042

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/20/2025

Vulnerability Publication Date: 3/20/2025

Reference Information

CVE: CVE-2024-11042