Invoke, published as InvokeAI, is the image generator that looks most like a design tool. Its Unified Canvas works in layers, with inpainting, outpainting, regional prompts and control images painted straight onto the image, and a node editor sits beside it for repeatable workflows. A model manager installs checkpoints from Hugging Face or Civitai, and the gallery keeps every image's settings for recall. It runs Stable Diffusion 1.5 and SDXL, SD 3.5, Flux.1 and Flux.2 Klein, Z-Image, Qwen Image and more, plus a few API-only models such as GPT Image.
It is one of the oldest projects in local image generation, started in August 2022, with 226 releases and a codebase split between a Python server and a React front end. The company behind it ran a hosted version until its founding team joined Adobe; the hosted platform was shut down and stewardship passed to two long-time core maintainers, Lincoln Stein and blessedcoolant, who still ship regularly (6.14.1 in September 2026). The licence is Apache-2.0, which makes it the most permissive of the big image UIs.
- Repository: github.com/invoke-ai/InvokeAI
- Licence: Apache-2.0 (Apache License 2.0)
- Language: Python. Stars: 28.3K. Forks: 2,980. Last push: Sep 26, 2026.
- Scan: safe, Sep 26, 2026, commit fac15fe
Who it is for
Artists and designers who want to paint, mask and iterate on an image rather than wire a graph, and teams that need a commercially friendly licence for a local generation tool.
Getting started
1. Easiest: download the Invoke Launcher for Windows, macOS or Linux, which installs and updates everything
open https://github.com/invoke-ai/launcher/releases/latest2. Or install manually with uv: make a folder, then a virtual environment with its own Python 3.12
mkdir ~/invokeai && cd ~/invokeai && uv venv --relocatable --prompt invoke --python 3.12 --python-preference only-managed .venv && source .venv/bin/activate3. Install a release (6.14.1 was current when scanned; the docs list a --torch-backend value to add for NVIDIA, AMD or Intel GPUs)
uv pip install invokeai==6.14.1 --python 3.12 --python-preference only-managed --force-reinstall4. Start the server, then open http://localhost:9090
invokeai-web --root ~/invokeaiThere is also a Docker image: docker run --runtime=nvidia --gpus=all --publish 9090:9090 ghcr.io/invoke-ai/invokeai. Models are not included; install them from the model manager in the interface.
Safety scan
We cloned invoke-ai/InvokeAI at commit fac15fe on Sep 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no pattern hits and no committed binaries across about 640,000 lines of Python and TypeScript. The bare-IP URLs are all in tests: a documentation-range address in a provider test, and the SSRF filter's test table (tests/app/util/test_ssrf.py), which lists public and reserved addresses precisely to check they are handled.
- The scan ran with Git LFS disabled, so LFS files were read as pointer files. .gitattributes routes only two folders through LFS, tests/test_model_probe/stripped_models and tests/model_identification/stripped_models: stripped model files for the model-identification tests. Nothing the application runs is stored in LFS, so nothing that ships went unread.
- One install hook, the front end's preinstall of npx only-allow pnpm, which only refuses installs through npm or yarn. docker/run.sh (37 lines) builds and starts the Compose service; no sudo, no download piped to a shell. The server binds to 127.0.0.1 unless you change host in its config, and .ckpt and .pt models are checked with picklescan before loading unless unsafe_disable_picklescan is set.
- 211 known advisories across three lockfiles. The runtime Python lock, uv.lock, has 264 packages with 1 critical (anyio's TLS host-name encoding) and 41 high. The web front end's pnpm lockfile has 1 critical and 55 high, mostly build tooling (Vite, PostCSS, brace-expansion) that compiles into a static bundle; the docs site's Astro lockfile (2 critical) never ships.
- 15 workflows. One uses pull_request_target: label-pr.yml runs actions/labeler, checks out the base branch rather than the pull request, and can only write labels. 8 of 24 third-party actions are pinned to a commit. Security policy and licence present; no Dependabot or CodeQL.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 1 npm lifecycle script. 1 installer script |
| Committed binaries | None. |
| CI workflows | 15 workflows. 1 uses pull_request_target, none check out the pull request head. 16 of 24 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, huggingface.co, arxiv.org, support.invoke.ai. 7 URLs to a bare IP address, listed under the raw findings. |
| Known vulnerabilities | 211 advisories across 1,800 pinned packages: 4 critical, 107 high, 77 moderate, 23 low. docs/pnpm-lock.yaml: 606 packages, 61 advisories; invokeai/frontend/web/pnpm-lock.yaml: 1,026 packages, 86 advisories; uv.lock: 264 packages, 74 advisories. |
| Project hygiene | Has security policy, licence file. Missing automated dependency updates, CodeQL, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
URLs to bare IP addresses (7)
| Where | Rule | Match |
|---|---|---|
| tests/app/services/external_generation/test_alibabacloud_provider.py:445 | ip-literal-url | monkeypatch.setenv(var, "http://198.51.100.9:8080") |
| tests/app/util/test_ssrf.py:52 | ip-literal-url | "http://100.64.0.1/x", # RFC 6598 shared address space -- not is_private |
| tests/app/util/test_ssrf.py:53 | ip-literal-url | "http://198.18.0.1/x", # benchmarking range -- not is_reserved |
| tests/app/util/test_ssrf.py:78 | ip-literal-url | ["http://93.184.216.34/x", "https://8.8.8.8/x", "http://[2606:4700:4700::1111]/x"], |
| tests/app/util/test_ssrf.py:78 | ip-literal-url | ["http://93.184.216.34/x", "https://8.8.8.8/x", "http://[2606:4700:4700::1111]/x"], |
| tests/app/util/test_ssrf.py:245 | ip-literal-url | "http://100.63.255.255/x", # just below the shared address space |
| tests/app/util/test_ssrf.py:246 | ip-literal-url | "http://100.128.0.1/x", # just above it |
npm lifecycle scripts (1)
invokeai/frontend/web/package.jsonpreinstall:npx only-allow pnpm
Installer scripts (1)
- docker/run.sh, 37 lines
Worst known vulnerabilities (24 of 211)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-26w7-cxv4-gfx2 | critical | astro@6.3.7 | Astro: Remote code execution through AVIF image optimization |
| GHSA-23hp-3jrh-7fpw | critical | tar@7.5.15 | node-tar: Decompression/parse DoS via unlimited input |
| GHSA-w7jw-789q-3m8p | critical | shell-quote@1.8.3 | shell-quote quote() does not escape newlines in object .op values |
| GHSA-82r6-8w77-94w6 | critical | anyio@4.14.1 | AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing |
| GHSA-2pvr-wf23-7pc7 | high | astro@6.3.7 | Astro: Host header SSRF in prerendered error page fetch |
| GHSA-2883-xcg3-v3hh | high | js-yaml@4.1.1 | js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources |
| GHSA-52cp-r559-cp3m | high | js-yaml@4.1.1 | js-yaml: YAML merge-key chains can force quadratic CPU consumption |
| GHSA-5p4m-2wfm-xmqj | high | js-yaml@4.1.1 | JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) - CVE-2026-59870 fix not backported |
| GHSA-28wg-ghj8-5hjv | high | nanoid@3.3.12 | nanoid: non-secure generators can loop indefinitely with negative size |
| GHSA-2v37-7h3g-55p8 | high | nanoid@3.3.12 | nanoid: custom generators can loop indefinitely when size is zero |
| GHSA-r28c-9q8g-f849 | high | postcss@8.5.14 | PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure |
| GHSA-r28c-9q8g-f849 | high | postcss@8.5.15 | PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure |
| GHSA-f88m-g3jw-g9cj | high | sharp@0.34.5 | sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 |
| GHSA-rgj7-g3m4-5g8c | high | sharp@0.34.5 | sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545 |
| GHSA-7w5x-hrqm-74c2 | high | smol-toml@1.6.1 | smol-toml: Denial of Service via malformed TOML documents |
| GHSA-2p49-hgcm-8545 | high | svgo@4.0.1 | SVGO removeScripts plugin leaves some executable scripts intact |
| GHSA-w27v-7q3p-w38r | high | svgo@4.0.1 | SVGO: removeScripts allows executable links through namespace and control-character bypasses |
| GHSA-8x88-c5mf-7j5w | high | tar@7.5.15 | node-tar: Negative tar entry size causes infinite loop in archive replace |
| GHSA-r292-9mhp-454m | high | tar@7.5.15 | node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar w… |
| GHSA-vxpw-j846-p89q | high | undici@6.25.0 | undici WebSocket client vulnerable to denial of service via fragment count bypass |
| GHSA-fx2h-pf6j-xcff | high | vite@7.3.3 | vite: `server.fs.deny` bypass on Windows alternate paths |
| GHSA-3jxr-9vmj-r5cp | high | brace-expansion@1.1.12 | brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups |
| GHSA-mh99-v99m-4gvg | high | brace-expansion@1.1.12 | brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
| GHSA-rgw5-rvv9-x895 | high | brace-expansion@1.1.12 | brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation |
Workflows worth a look
- .github/workflows/label-pr.yml: pull_request_target
By the numbers
| Stars | 28.3K |
|---|---|
| Forks | 2,980 |
| Contributors | 399 |
| Commits | 19.2K |
| Open issues | 321 |
| Open pull requests | 36 |
| Releases | 226 |
| Latest release | v6.14.1 |
| Licence | Apache-2.0 |
| Main language | Python |
| Project age | 4 years |
| Last push | Sep 26, 2026 |
| Tracked files | 3,991 |
| Lines of code | 639.3K |
| Checkout size | 93 MB |
Lines by language: Python 290.9K, TypeScript 263.4K, JSON 58.9K, Markdown 19.6K, YAML 4,326, JavaScript 643.
Questions
Is InvokeAI free?
Yes. Invoke is Apache-2.0, free for personal and commercial use, and runs entirely on your own hardware. The paid hosted platform was shut down when the founding team joined Adobe, and the project is now community-maintained. Models carry their own licences (some Flux weights are non-commercial), and the API-only models bill through their providers.
InvokeAI or ComfyUI?
Invoke if you think in layers and brushes: its canvas makes inpainting, outpainting and regional prompting feel like editing in an image app, and its node workflows cover repeatable pipelines. ComfyUI if you want every new model the week it appears and the largest ecosystem of custom nodes. Both run the same model families and both are free.
What GPU does InvokeAI need?
The docs give minimums per model: SD 1.5 wants 4 GB of VRAM and 8 GB of RAM, SDXL 8 GB and 16 GB, Flux.1 10 GB and 32 GB. NVIDIA cards work on Windows and Linux, AMD on Linux only, Intel Arc on both, and any Apple Silicon Mac works, with 16 GB of memory or more recommended.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.