Graphite is a 2D graphics editor that looks like a familiar layer-based design app on the surface and runs on a node graph underneath. Every shape, boolean operation, pattern and effect stays editable after the fact, so you can change a parameter at the start of a design and see everything downstream update. That nondestructive, procedural approach is what sets it apart from Inkscape or Illustrator, and it makes generative patterns, repeated elements and parametric layouts easy.
It started as a vector editor and is growing into an all-round 2D toolbox: raster editing, digital painting, motion graphics, desktop publishing and compositing are on the roadmap, built more like a game engine than a typical creative app. The engine is written in Rust and compiled to WebAssembly, so the full editor runs in a browser tab at editor.graphite.art with nothing to install.
It is still alpha: expect missing features and rough edges next to mature tools. It is community-built and funded, dual-licensed MIT or Apache-2.0, with about 27,700 stars and 187 contributors.
- Repository: github.com/GraphiteEditor/Graphite
- Licence: Apache-2.0 (Apache License 2.0)
- Language: Rust. Stars: 27.7K. Forks: 1,299. Last push: Oct 26, 2026.
- Scan: safe, Oct 26, 2026, commit 3bb5bde
Who it is for
Designers and digital artists curious about procedural, node-based workflows, people who want a free vector editor that runs anywhere, and Rust developers looking for an approachable graphics project to contribute to.
Getting started
1. Clone the source (or skip all this and use the browser editor at editor.graphite.art)
git clone https://github.com/GraphiteEditor/Graphite.git2. Build and run the dev server at http://localhost:8080 (needs Rust and Node.js)
cd Graphite && cargo runcargo run checks for the system dependencies it needs and helps install any that are missing before starting the editor in your browser.
Safety scan
We cloned GraphiteEditor/Graphite at commit 3bb5bde on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious code patterns, no committed binaries and no bare-IP URLs across about 259,000 lines of Rust.
- The one npm hook is the website's postinstall (website/.build-scripts/install.ts). It copies font files out of node_modules, downloads text-balancer.js from static.graphite.art and pulls favicons from the project's branding archive. It only runs when building the graphite.art website. Seven Cargo build scripts compile shaders, resources and the licence list.
- 117 known advisories (2 critical, 51 high): 46 hits in the main Cargo.lock, one critical in the zip crate's extract function, 23 in the rawkit library's lockfile, and 67 across the npm lockfiles for the frontend and website build tooling. The browser editor runs in the browser's sandbox.
- Ten workflows, none using pull_request_target, and all 24 third-party actions pinned to commits. The scanner reports no licence file because the project uses two, LICENSE-MIT and LICENSE-APACHE; no security policy, Dependabot or CodeQL.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 1 npm lifecycle script. 7 Cargo build scripts |
| Committed binaries | None. |
| CI workflows | 10 workflows. None use pull_request_target. 0 of 24 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, www.adobe.com, graphite.art, files.keavon.com. No URLs to bare IP addresses. |
| Known vulnerabilities | 117 advisories across 1,307 pinned packages: 2 critical, 51 high, 32 moderate, 8 low, 24 unrated. Cargo.lock: 788 packages, 46 advisories; frontend/package-lock.json: 426 packages, 58 advisories; libraries/rawkit/Cargo.lock: 288 packages, 23 advisories; tools/web-editor-driver/playwright/package-lock.json: 1 packages, 0 advisories; website/package-lock.json: 32 packages, 9 advisories. |
| Project hygiene | Has none of the usual files. Missing security policy, automated dependency updates, CodeQL, licence file, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
npm lifecycle scripts (1)
website/package.jsonpostinstall:node .build-scripts/install.ts
Worst known vulnerabilities (24 of 117)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-4684-h2q9-2vcp | critical | zip@8.6.0 | ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the targe… |
| GHSA-23hp-3jrh-7fpw | critical | tar@7.5.13 | node-tar: Decompression/parse DoS via unlimited input |
| GHSA-394x-vwmw-crm3 | high | aws-lc-sys@0.37.1 | AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN |
| GHSA-65p9-r9h6-22vj | high | aws-lc-sys@0.37.1 | AWS-LC has Timing Side-Channel in AES-CCM Tag Verification |
| GHSA-9f94-5g5w-gf6r | high | aws-lc-sys@0.37.1 | CRL Distribution Point Scope Check Logic Error in AWS-LC |
| GHSA-hfpc-8r3f-gw53 | high | aws-lc-sys@0.37.1 | AWS-LC has PKCS7_verify Signature Validation Bypass |
| GHSA-vw5v-4f2q-w9xf | high | aws-lc-sys@0.37.1 | AWS-LC has PKCS7_verify Certificate Chain Validation Bypass |
| GHSA-cfwj-9wp5-wqvp | high | aws-lc-sys@0.37.1 | PKCS7_verify Certificate Chain Validation Bypass in AWS-LC |
| RUSTSEC-2026-0194 | high | quick-xml@0.38.3 | Quadratic run time when checking a start tag for duplicate attribute names |
| RUSTSEC-2026-0195 | high | quick-xml@0.38.3 | Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service |
| GHSA-4w2j-m93h-cj5j | high | quinn-proto@0.11.13 | Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly |
| GHSA-6xvm-j4wr-6v98 | high | quinn-proto@0.11.13 | Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing |
| GHSA-3g6h-r5qx-f6hq | high | quinn-proto@0.11.13 | Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled |
| GHSA-82j2-j2ch-gfr8 | high | rustls-webpki@0.103.4 | rustls-webpki: Denial of service via panic on malformed CRL BIT STRING |
| GHSA-vv5m-jxxh-4627 | high | zip@8.6.0 | Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation |
| GHSA-3jxr-9vmj-r5cp | high | brace-expansion@5.0.5 | brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups |
| GHSA-6j4f-fj2g-mc7p | high | brace-expansion@5.0.5 | brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
| GHSA-mh99-v99m-4gvg | high | brace-expansion@5.0.5 | brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
| GHSA-qhr7-859c-m2p7 | high | brace-expansion@5.0.5 | brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
| GHSA-rgw5-rvv9-x895 | high | brace-expansion@5.0.5 | brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation |
| GHSA-3jxr-9vmj-r5cp | high | brace-expansion@1.1.13 | brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups |
| GHSA-6j4f-fj2g-mc7p | high | brace-expansion@1.1.13 | brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
| GHSA-mh99-v99m-4gvg | high | brace-expansion@1.1.13 | brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
| GHSA-qhr7-859c-m2p7 | high | brace-expansion@1.1.13 | brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
By the numbers
| Stars | 27.7K |
|---|---|
| Forks | 1,299 |
| Contributors | 187 |
| Commits | 3,274 |
| Open issues | 402 |
| Open pull requests | 51 |
| Releases | 1 |
| Latest release | none tagged |
| Licence | Apache-2.0 |
| Main language | Rust |
| Project age | 6 years |
| Last push | Oct 26, 2026 |
| Tracked files | 1,177 |
| Lines of code | 304.5K |
| Checkout size | 18 MB |
Lines by language: Rust 258.9K, Svelte 19.6K, Markdown 6,900, TypeScript 6,844, SCSS 3,446, TOML 3,177.
Questions
Is Graphite free?
Yes. Graphite is free and open source, dual-licensed under MIT or Apache-2.0 at your choice, with no paid tier. The project is funded by community donations.
Can Graphite replace Illustrator or Inkscape?
Not yet for most professional work. Graphite is in alpha, so some tools and file format support are still missing. Where it already shines is procedural and generative design, where its node graph keeps every step editable in a way traditional editors cannot.
Do I need to install Graphite?
No. The full editor runs in a modern browser at editor.graphite.art, with your work processed locally in WebAssembly. Building from source is only needed if you want to develop it.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.