gitsafehub
github.com/invoke-ai/invokeai ↗

invoke-ai/invokeai

scanned 2026-07-18 · git 82e2681
3 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets10Vulnerable dependencies58Known OSS vulnerabilities162Risky code patterns✓Malicious dependencies—Project health5

Security checks

Leaked secrets — Gitleaksⓘ 10 found

API keys, passwords or tokens committed into the repo.

  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    docs/src/content/docs/features/Multi-User Mode/api-guide.mdx:66
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    invokeai/app/services/workflow_records/default_workflows/MultiDiffusion SDXL.json:300
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    invokeai/backend/model_manager/load/model_loaders/qwen_image.py:196
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    invokeai/backend/model_manager/load/model_loaders/z_image.py:9
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    invokeai/frontend/web/src/features/nodes/util/graph/generation/Graph.test.ts:650
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    invokeai/frontend/web/src/features/nodes/util/graph/generation/Graph.test.ts:680
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    invokeai/frontend/web/src/features/nodes/util/graph/generation/buildFLUXGraph.test.ts:56
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    invokeai/frontend/web/src/features/nodes/util/workflow/validateWorkflow.test.ts:53
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    tests/app/routers/test_model_relationships.py:20
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    tests/app/routers/test_model_relationships.py:21
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 58 found

Packages you depend on that have known security holes (CVEs).

  • Worth fixing CVE-2026-54299 Astro: Host header SSRF in prerendered error page fetch
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-54299). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-54298 Astro: XSS via Unescaped Attribute Names in Spread Props
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-54298). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41238 DOMPurify: DOMPurify: Cross-Site Scripting bypass via prototype pollution
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41238). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41239 DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41239). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41240 DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41240). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49458 dompurify: DOMPurify: Cross-site scripting due to improper sanitization of DOM nodes
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-49458). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49459 dompurify: DOMPurify: Cross-site scripting bypass allows arbitrary script execution
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-49459). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49978 dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-49978). Fix: Update that package to its patched version.
  • Worth fixing GHSA-39q2-94rc-95cp DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (GHSA-39q2-94rc-95cp). Fix: Update that package to its patched version.
  • Worth fixing GHSA-76mc-f452-cxcm DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (GHSA-76mc-f452-cxcm). Fix: Update that package to its patched version.
  • Worth fixing GHSA-cmwh-pvxp-8882 DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (GHSA-cmwh-pvxp-8882). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-53550 js-yaml: js-yaml: Denial of Service via crafted YAML merge keys
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-53550). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41907 uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41907). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-53571 vite: `server.fs.deny` bypass on Windows alternate paths
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-53571). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-53632 launch-editor: launch-editor: Credential compromise via NTLMv2 password hash leak through UNC path access
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-53632). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41691 i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns
    invokeai/frontend/web/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41691). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-46625 js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution
    invokeai/frontend/web/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-46625). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-33151 socket.io: Socket.IO: Denial of Service due to excessive buffering of specially crafted packets
    invokeai/frontend/web/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-33151). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41907 uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality
    invokeai/frontend/web/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41907). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-48779 ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments
    invokeai/frontend/web/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-48779). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-45736 ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`
    invokeai/frontend/web/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-45736). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-33532 yaml: yaml: Denial of Service via deeply nested YAML document parsing
    invokeai/frontend/web/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-33532). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44513 Diffusers: Diffusers: Arbitrary remote code execution via `trust_remote_code` bypass
    uv.lock
    A package you depend on has a known security hole (CVE-2026-44513). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-45804 diffusers: Diffusers: Arbitrary code execution due to trust_remote_code guard bypass
    uv.lock
    A package you depend on has a known security hole (CVE-2026-45804). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-5187 A vulnerability in the `download_model_with_test_data` function of the ...
    uv.lock
    A package you depend on has a known security hole (CVE-2024-5187). Fix: Update that package to its patched version.
… 33 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 162 found · 7 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious PYSEC-2022-43015 In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is used unsafely.
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/invokeai/backend/image_util/normal_bae/nets/submodules/efficientnet_repo/requirements.txt
    A package you depend on has a known security hole (CVE-2022-45907). Fix: Update that package to its patched version.
  • Serious PYSEC-2024-259 In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distributed computing.
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/invokeai/backend/image_util/normal_bae/nets/submodules/efficientnet_repo/requirements.txt
    A package you depend on has a known security hole (CVE-2024-48063). Fix: Update that package to its patched version.
  • Serious PYSEC-2025-41 PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command E
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/invokeai/backend/image_util/normal_bae/nets/submodules/efficientnet_repo/requirements.txt
    A package you depend on has a known security hole (CVE-2025-32434). Fix: Update that package to its patched version.
  • Serious PYSEC-2026-457 Arbitrary Code Execution in Pillow
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/invokeai/backend/image_util/normal_bae/nets/submodules/efficientnet_repo/requirements.txt
    A package you depend on has a known security hole (CVE-2023-50447). Fix: Update that package to its patched version.
  • Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/invokeai/frontend/web/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
  • Serious PYSEC-2025-10 A vulnerability in the `download_model` function of the onnx/onnx framework, before and including version 1.16.1, allows for arbitrary file overwrite due to inadequate prevention of path traversal att
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/uv.lock
    A package you depend on has a known security hole (CVE-2024-7776). Fix: Update that package to its patched version.
  • Serious PYSEC-2026-103 Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and including 1.20.1, a security control bypass exists in onnx.hub.load() due to improp
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/uv.lock
    A package you depend on has a known security hole (CVE-2026-28500). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2pvr-wf23-7pc7 Astro: Host header SSRF in prerendered error page fetch
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-54299). Fix: Update that package to its patched version.
  • Worth fixing GHSA-jrpj-wcv7-9fh9 Astro: XSS via Unescaped Attribute Names in Spread Props
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-54298). Fix: Update that package to its patched version.
  • Worth fixing GHSA-39q2-94rc-95cp DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/docs/pnpm-lock.yaml
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-76mc-f452-cxcm DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/docs/pnpm-lock.yaml
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-cmwh-pvxp-8882 DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/docs/pnpm-lock.yaml
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-crv5-9vww-q3g8 DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41239). Fix: Update that package to its patched version.
  • Worth fixing GHSA-h7mw-gpvr-xq4m DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41240). Fix: Update that package to its patched version.
  • Worth fixing GHSA-hpcv-96wg-7vj8 DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-49458). Fix: Update that package to its patched version.
  • Worth fixing GHSA-r47g-fvhr-h676 DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-49459). Fix: Update that package to its patched version.
  • Worth fixing GHSA-rp9w-3fw7-7cwq DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-49978). Fix: Update that package to its patched version.
  • Worth fixing GHSA-v9jr-rg53-9pgp DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41238). Fix: Update that package to its patched version.
  • Worth fixing GHSA-h67p-54hq-rp68 JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-53550). Fix: Update that package to its patched version.
  • Worth fixing GHSA-vmf3-w455-68vh node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-53655). Fix: Update that package to its patched version.
  • Worth fixing GHSA-p88m-4jfj-68fv undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-9679). Fix: Update that package to its patched version.
  • Worth fixing GHSA-vxpw-j846-p89q undici WebSocket client vulnerable to denial of service via fragment count bypass
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-12151). Fix: Update that package to its patched version.
  • Worth fixing GHSA-w5hq-g745-h8pq uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41907). Fix: Update that package to its patched version.
  • Worth fixing GHSA-fx2h-pf6j-xcff vite: `server.fs.deny` bypass on Windows alternate paths
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-53571). Fix: Update that package to its patched version.
  • Worth fixing GHSA-v6wh-96g9-6wx3 launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
    /workdirs/scan-9b724daf-f547-40b5-81cc-ac4118a5d727/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-53632). Fix: Update that package to its patched version.
… 137 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ timed out

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: pypi:timeout

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ 5 notes

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

  • Minor scorecard-CII-Best-Practices CII-Best-Practices scored 0: no effort to earn an OpenSSF best practices badge detected
    A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
  • Minor scorecard-Fuzzing Fuzzing scored 0: project is not fuzzed
    A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
  • Minor scorecard-SAST SAST scored 0: SAST tool is not run on all commits -- score normalized to 0
    A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
  • Minor scorecard-Token-Permissions Token-Permissions scored 0: detected GitHub workflow tokens with excessive permissions
    A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
  • FYI scorecard-overall OpenSSF Scorecard overall: 7.0/10
    A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.

via OpenSSF Scorecard v5.5.0 · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.