CVE-2024-32022

Kohya_ss is vulnerable to a command injection in basic_caption_gui.py (GHSL-2024-019)

CVSS 9.1 CRITICALEPSS 3.1%CWE-77

Vexday Risk Score

48Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 9.1EPSS 3.1%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

16 Apr 2024Published on NVD

22 Sep 2025Public PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to command injection in basic_caption_gui.py. This vulnerability is fixed in 23.1.5.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

bmaltais · kohya_ss

public PoCs found — 1

githubgithub.com/sylwia-budzynska/codeql-workshop★ 10

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/bmaltais/kohya_ss/commit/831af8babeb75faff62bcc6a8c6a4f80354f1ff1 https://github.com/bmaltais/kohya_ss/security/advisories/GHSA-m6jq-7j4v-2fg3 https://securitylab.github.com/advisories/GHSL-2024-019_GHSL-2024-024_kohya_ss