Invoke-ai vulnerabilities
We track 5 vulnerabilities in Invoke-ai products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 18, 2025.
Latest Invoke-ai vulnerabilities
- 9.8 Critical severity
invoke-ai/invokeai: External Control of File Name or Path
A vulnerability in invokeai version v6.0.0a1 and below allows attackers to perform path traversal and arbitrary file deletion via the GET /api/v1/images/download/{bulk_download_item_name} endpoint. By manipulating the filename arguments, attackers can read and
- 9.8 Critical severity
invoke-ai/invokeai: Deserialization of Untrusted Data
A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can ex
- 7.5 High severity
invoke-ai/invokeai: Uncontrolled Resource Consumption
A Denial of Service (DoS) vulnerability was discovered in the /api/v1/boards/{board_id} endpoint of invoke-ai/invokeai version v5.0.2. This vulnerability occurs when an excessively large payload is sent in the board_name field during a PATCH request. By sendin
- 9.1 Critical severity
invoke-ai/invokeai: External Control of File Name or Path
In invoke-ai/invokeai version v5.0.2, the web API `POST /api/v1/images/delete` is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized attackers to delete arbitrary files on the server, potentially including critical or sensitive syste
- 7.5 High severity
invoke-ai/invokeai: Loop with Unreachable Exit Condition
A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of the Invoke-AI server (version v5.0.1) allows unauthenticated attackers to cause excessive resource consumption. The server fails to handle excessive characters ap