CVE-2024-32025: Bmaltais Kohya Ss

Critical severity, CVSS 9.1. EPSS: 2.5% chance of exploitation in the next 30 days.

Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to a command injection in `group_images_gui.py`. This vulnerability is fixed in 23.1.5.

Affected products

• Bmaltais Kohya Ss: from 22.6.1, before 24.0.1 (fixed in 24.0.1)

Published 2024-04-16. Last modified 2026-06-17.