InvokeAI

InvokeAI Version 6.13.7

⚠️ This is a security patch release

All recent versions of InvokeAI through 6.13.6 contain a security hole that potentially allows an attacker to recover the contents of the running instance's invokeai.yaml and api_keys.yaml files. These files can contain sensitive data including API keys for image generation hosting services and API download tokens for HuggingFace and other model download sites.

Your keys/tokens may have been compromised if:

1. Your invokeai.yaml file contains download API tokens for any model provider (e.g. Civitai, HuggingFace),
2. Your api_keys.yaml file contains API keys for one or more remote image generation services (e.g. Alibaba, OpenAI),
3. At any point, you set the listen host to 0.0.0.0 to enable network access to your InvokeAI machine, and
4. Either you exposed the InvokeAI machine to the Internet, or you share your LAN with untrusted individuals.

In the event that these apply to you, or just to be safe, please upgrade to version 6.13.7 and rotate your API tokens and keys.

👉 Note: The InvokeAI team discourages opening your InvokeAI host to the internet. If you choose to do so, we recommend that 1) you use the multiuser configuration and pick strong passwords; and 2) that you isolate the InvokeAI instance in a Docker container. 👈

Additional security fixes

This patch also closes a series of related but less critical security issues:

• Leakage of model paths: An attacker could recursively enumerate the paths of all models and model-like files, in an arbitrary directory on the Invoke server's filesystem.
• Testing existence of arbitrary paths: An attacker could also determine whether a certain file is present on the Invoke server's filesystem, even if it wasn't a model file.
• Administrator functions available to regular users: In multiuser mode, several functions intended for the use of Administrator users were available for use by unprivileged users. Not an obvious security hole, but a potential problem.

Many thanks to George Chen (@geo-chen), for reporting the original issue.

Full Changelog: https://github.com/invoke-ai/InvokeAI/compare/v6.13.6...v6.13.7

<div align="center">

project hero

Invoke - Professional Creative AI Tools for Visual Media

[![discord badge]][discord link] [![latest release badge]][latest release link] [![github stars badge]][github stars link] [![github forks badge]][github forks link] [![CI checks on main badge]][CI checks on main link] [![latest commit to main badge]][latest commit to main link] [![github open issues badge]][github open issues link] [![github open prs badge]][github open prs link] [![translation status badge]][translation status link]

[Sponsor Invoke][sponsor link]

</div>

Invoke is a leading creative engine built to empower professionals and enthusiasts alike. Generate and create stunning visual media using the latest AI-driven technologies. Invoke offers an industry leading web-based UI, and serves as the foundation for multiple commercial products.

• Free to use under a commercially-friendly license
• Download and install on compatible hardware
• Generate, refine, iterate on images, and build workflows

Highlighted Features - Canvas and Workflows

Documentation

| Quick Links |

| ----------------------------------------------------------------------------------------------------------------------------------------------------------- |

| [Installation and Updates][installation docs] - [Documentation and Tutorials][docs home] - [Bug Reports][github issues] - [Contributing][contributing docs] |

Installation

To get started with Invoke, Download the Launcher.

Troubleshooting, FAQ and Support

Please review our [FAQ][faq] for solutions to common installation problems and other issues.

For more help, please join our [Discord][discord link].

Features

Full details on features can be found in [our documentation][features docs].

Web Server & UI

Invoke runs a locally hosted web server & React UI with an industry-leading user experience.

Unified Canvas

The Unified Canvas is a fully integrated canvas implementation with support for all core generation capabilities, in/out-painting, brush tools, and more. This creative tool unlocks the capability for artists to create with AI as a creative collaborator, and can be used to augment AI-generated imagery, sketches, photography, renders, and more.

Workflows & Nodes

Invoke offers a fully featured workflow management solution, enabling users to combine the power of node-based workflows with the ease of a UI. This allows for customizable generation pipelines to be developed and shared by users looking to create specific workflows to support their production use-cases.

Board & Gallery Management

Invoke features an organized gallery system for easily storing, accessing, and remixing your content in the Invoke workspace. Images can be dragged/dropped onto any Image-base UI element in the application, and rich metadata within the Image allows for easy recall of key prompts or settings used in your workflow.

Model Support

• SD 1.5
• SD 2.0
• SDXL
• SD 3.5 Medium
• SD 3.5 Large
• CogView 4
• Flux.1 Dev
• Flux.1 Schnell
• Flux.1 Kontext
• Flux.1 Krea
• Flux Redux
• Flux Fill
• Flux.2 Klein 4B
• Flux.2 Klein 9B
• Z-Image Turbo
• Z-Image Base
• Krea 2 Turbo
• Krea 2 Raw
• Anima
• Qwen Image
• Qwen Image Edit
• Ideogram 4
• ERNIE-Image
• ERNIE-Image-Turbo
• Nano Banana (API Only)
• GPT Image (API Only)
• Wan (API Only)

Other features

• Support for ckpt, diffusers, and some gguf models
• Upscaling Tools
• Embedding Manager & Support
• Model Manager & Support
• Workflow creation & management
• Node-Based Architecture
• Object Segmentation & Selection Models (SAM / SAM2)

Contributing

Anyone who wishes to contribute to this project - whether documentation, features, bug fixes, code cleanup, testing, or code reviews - is very much encouraged to do so.

Get started with contributing by reading our [contribution documentation][contributing docs], joining the [#dev-chat] or the GitHub discussion board.

We hope you enjoy using Invoke as much as we enjoy creating it, and we hope you will elect to become part of our community.

Sponsors

Invoke's open-source development is powered by our sponsors. If Invoke is valuable to you or your business, please consider [sponsoring us][sponsor link] — it directly funds maintenance, new features, and community support.

<!-- Sponsor logos can be added below, or automated with a GitHub Action

such as JamesIves/github-sponsors-readme-action to keep them in sync. -->

[Sponsor Invoke][sponsor link]

We very much thank the following sponsors:

Backers ($15/mo)

• apokolypsse
• Romeotechguy

Power Users ($50/mo)

• mickr777

Thanks

Invoke is a combined effort of [passionate and talented people from across the world][contributors]. We thank them for their time, hard work and effort.

Original portions of the software are Copyright © 2024 by respective contributors.

[features docs]: https://invoke.ai/

[faq]: https://invoke.ai/troubleshooting/faq/

[contributors]: https://invoke.ai/contributing/contributors/

[github issues]: https://github.com/invoke-ai/InvokeAI/issues

[docs home]: https://invoke.ai

[installation docs]: https://invoke.ai/start-here/installation/

[sponsor link]: https://github.com/sponsors/invoke-ai

[#dev-chat]: https://discord.com/channels/1020123559063990373/1049495067846524939

[contributing docs]: https://invoke.ai/contributing/

[CI checks on main badge]: https://flat.badgen.net/github/checks/invoke-ai/InvokeAI/main?label=CI%20status%20on%20main&cache=900&icon=github

[CI checks on main link]: https://github.com/invoke-ai/InvokeAI/actions?query=branch%3Amain

[discord badge]: https://flat.badgen.net/discord/members/ZmtBAhwWhy?icon=discord

[discord link]: https://discord.gg/ZmtBAhwWhy

[github forks badge]: https://flat.badgen.net/github/forks/invoke-ai/InvokeAI?icon=github

[github forks link]: https://useful-forks.github.io/?repo=invoke-ai%2FInvokeAI

[github open issues badge]: https://flat.badgen.net/github/open-issues/invoke-ai/InvokeAI?icon=github

[github open issues link]: https://github.com/invoke-ai/InvokeAI/issues?q=is%3Aissue+is%3Aopen

[github open prs badge]: https://flat.badgen.net/github/open-prs/invoke-ai/InvokeAI?icon=github

[github open prs link]: https://github.com/invoke-ai/InvokeAI/pulls?q=is%3Apr+is%3Aopen

[github stars badge]: https://flat.badgen.net/github/stars/invoke-ai/InvokeAI?icon=github

[github stars link]: https://github.com/invoke-ai/InvokeAI/stargazers

[latest commit to main badge]: https://flat.badgen.net/github/last-commit/invoke-ai/InvokeAI/main?icon=github&color=yellow&label=last%20dev%20commit&cache=900

[latest commit to main link]: https://github.com/invoke-ai/InvokeAI/commits/main

[latest release badge]: https://flat.badgen.net/github/release/invoke-ai/InvokeAI/development?icon=github

[latest release link]: https://github.com/invoke-ai/InvokeAI/releases/latest

[translation status badge]: https://hosted.weblate.org/widgets/invokeai/-/svg-badge.svg

[translation status link]: https://hosted.weblate.org/engage/invokeai/

[nvidia docker docs]: https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/install-guide.html

[amd docker docs]: https://rocm.docs.amd.com/projects/install-on-linux/en/latest/how-to/docker.html