Executive brief
InvokeAI has External Control of File Name or Path
Affected products
- PyPI invokeai
Junglewise Threat Intelligence
CVE-2025-6237: PYSEC-2026-359 - InvokeAI has External Control of File Name or Path
CVE-2025-6237 · Severity: low · CVSS 3 · Published 2026-06-29
Technologies: invokeai (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1467 - InvokeAI Uncontrolled Resource Consumption vulnerability
- PYSEC-2026-1466 - InvokeAI has Denial of Service (DoS) vulnerability in `/api/v1/images/upload`
- PYSEC-2026-358 - InvokeAI Arbitrary File Deletion vulnerability
- PYSEC-2025-9 - A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vuln