invoke-ai/InvokeAI

invoke-ai/InvokeAI

GitHubGitHub
GitHubgithub.com
invoke-ai.github.ioinvoke-ai.github.io
Releases401
Frequency3 days 14 hours
Last Release
Stars27.6K
Invoke is a leading creative engine for Stable Diffusion models, empowering professionals, artists, and enthusiasts to generate and create visual media using the latest AI-driven technologies. The solution offers an industry leading WebUI, and serves as the foundation for multiple commercial products.
Log in to subscribe

CVE History

CVEAffectedPublishedCVSS v3CVSS v2
CVE-2026-65012NVD↗
—5.3 MEDIUM—

InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scan_folder endpoint that accepts attacker-controlled scan_path parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP response codes to determine file existence and readability, bypassing multi-user mode access controls.

CVE-2024-12029NVD↗
>= 5.3.1, < 5.4.3rc2, >= 5.3.1, < 5.4.3rc1——

A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can exploit this by embedding malicious code in model files, which is executed upon loading. This issue is fixed in version 5.4.3.

CVE-2024-11042NVD↗
< 5.3.0rc1——

In invoke-ai/invokeai version v5.0.2, the web API `POST /api/v1/images/delete` is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized attackers to delete arbitrary files on the server, potentially including critical or sensitive system files such as SSH keys, SQLite databases, and configuration files. This can impact the integrity and availability of applications relying on these files.