CVE-2024-12029

This repository contains functional exploit code for CVE-2024-12029, targeting InvokeAI's pickle deserialization vulnerability. It includes multiple payloads (reverse shells, callback tests) and a test script to verify exploitation.

This Metasploit module exploits a deserialization vulnerability in InvokeAI's /api/v2/models/install endpoint, allowing remote code execution by serving a malicious model file that executes arbitrary commands upon loading via torch.load.