Kohya's GUI, the kohya_ss repository, is the friendly front end for Kohya's sd-scripts, the training scripts most people use to make their own LoRA models. Instead of assembling a long command line, you fill in a Gradio web form with your images, captions, base model and settings, and it builds and runs the training command for you, showing the exact command so you can learn from it or reuse it.
It covers LoRA, LoHa, LoKr, DreamBooth, full fine-tuning, textual inversion and LECO concept editing, on Stable Diffusion 1.5 and 2.x, SDXL, SD3, Flux.1, Lumina Image 2.0, HunyuanImage 2.1 and others. Captioning tools, sample images during training, masked loss and multi-GPU options are built in. That breadth is why it is the default recommendation in most LoRA training guides.
Limits: you need an NVIDIA GPU with enough memory for your base model (macOS support varies), installs are large, and training settings take practice to get right. It is Apache-2.0, with about 12,600 stars and 159 contributors.
- Repository: github.com/bmaltais/kohya_ss
- Licence: Apache-2.0 (Apache License 2.0)
- Language: Python. Stars: 12.6K. Forks: 1,606. Last push: Aug 1, 2026.
- Scan: safe, Oct 26, 2026, commit 45088f0
Who it is for
Artists and hobbyists who want to teach an image model a style, character or product, and anyone who has outgrown pre-made LoRAs and has a capable NVIDIA GPU or a rented cloud one.
Getting started
1. Clone with its submodules
git clone --recursive https://github.com/bmaltais/kohya_ss.git2. Install and launch the GUI with uv on Linux (Windows: .\gui-uv.bat)
cd kohya_ss && ./gui-uv.shIf uv is missing, gui-uv.sh asks before installing it with Astral's curl | sh installer. Leave off the --share flag unless you want Gradio to publish the interface on a public link. pip-based installs and Runpod, Novita and Docker guides are in the docs folder.
Safety scan
We cloned bmaltais/kohya_ss at commit 45088f0 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no committed binaries and no bare-IP URLs. The one pattern hit is gui-uv.sh offering to install uv by piping Astral's installer to sh, and it asks first.
- setup.sh (663 lines), the older pip installer, uses sudo to install system packages; setup.ps1 and setup-runpod.sh do not. Hosts in the code are the expected ones: PyTorch and NVIDIA downloads, Hugging Face, Weights and Biases for optional logging, and Colab.
- 258 known advisories, 12 critical, with 198 hits in uv.lock and the rest spread across the platform requirements files. They include PyTorch's torch.load remote code execution flaw in older pinned versions, plus Pillow, certifi, anyio, GitPython and Brotli. These are libraries the training actually runs, so prefer safetensors files from trusted sources and keep the install updated.
- Two workflows, none using pull_request_target; none of the 7 third-party actions is pinned to a commit. Security policy, Dependabot and licence present; no CodeQL.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | 1 pattern hit found and read; every one is listed under the raw findings. |
| Install-time code | 3 installer scripts (one can call sudo) |
| Committed binaries | None. |
| CI workflows | 2 workflows. None use pull_request_target. 7 of 7 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 19 distinct hosts referenced from source; most often github.com, astral.sh, colab.research.google.com, download.pytorch.org. No URLs to bare IP addresses. |
| Known vulnerabilities | 258 advisories across 194 pinned packages: 12 critical, 146 high, 71 moderate, 28 low, 1 unrated. requirements.txt: 33 packages, 26 advisories; requirements_ipex_xpu.txt: 5 packages, 9 advisories; requirements_linux.txt: 5 packages, 14 advisories; requirements_linux_rocm.txt: 7 packages, 9 advisories; requirements_macos_amd64.txt: 2 packages, 23 advisories; requirements_macos_arm64.txt: 2 packages, 0 advisories; requirements_pytorch_windows.txt: 2 packages, 14 advisories; requirements_runpod.txt: 7 packages, 19 advisories; requirements_windows.txt: 1 packages, 0 advisories; uv.lock: 175 packages, 198 advisories. |
| Project hygiene | Has security policy, automated dependency updates, licence file. Missing CodeQL, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Pattern hits (1)
| Where | Rule | Match |
|---|---|---|
| gui-uv.sh:42 | download-piped-to-shell | curl -LsSf https://astral.sh/uv/install.sh | sh |
Installer scripts (3)
- setup-runpod.sh, 38 lines
- setup.ps1, 18 lines
- setup.sh, 663 lines, uses sudo; talks to brew.sh, github.com, mycustom.repo.tld, stackoverflow.com
Worst known vulnerabilities (24 of 258)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-53q9-r3pm-6pq6 | critical | torch@2.0.0 | PyTorch: `torch.load` with `weights_only=True` leads to remote code execution |
| CVE-2024-48063 | critical | torch@2.0.0 | |
| GHSA-53q9-r3pm-6pq6 | critical | torch@2.5.0+cu124 | PyTorch: `torch.load` with `weights_only=True` leads to remote code execution |
| GHSA-82r6-8w77-94w6 | critical | anyio@4.9.0 | AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing |
| GHSA-9v8h-qqgm-4m35 | critical | brotli@1.2.0 | Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package |
| GHSA-6q48-6c7w-9gw2 | critical | certifi@2025.6.15 | certifi bundles emSign root CAs with compromised intermediate CA keys |
| GHSA-284h-m62q-gf8w | critical | gitpython@3.1.44 | GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any… |
| GHSA-332p-7hrc-92wf | critical | pillow@11.2.1 | Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO |
| GHSA-5x8w-8jj5-q52h | critical | pillow@11.2.1 | Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution |
| GHSA-8g5g-8vmr-9782 | critical | pillow@11.2.1 | Pillow: Heap buffer overflow in ImagingJpegDecode |
| GHSA-v9pv-5gc8-w2m6 | critical | pillow@11.2.1 | Pillow multi-frame loaders can reuse stale native image storage after mode transitions |
| GHSA-w889-685w-c8fh | critical | pillow@11.2.1 | Pillow: Argument Injection in Ghostscript call, potentially leading into RCE |
| GHSA-7wx4-6vff-v64p | high | diffusers@0.32.2 | Diffusers: TOCTOU Trust Remote Code Bypass |
| GHSA-98h9-4798-4q5v | high | diffusers@0.32.2 | Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components |
| GHSA-j7w6-vpvq-j3gm | high | diffusers@0.32.2 | |
| GHSA-3r9x-f23j-gc73 | high | onnx@1.17.0 | onnx Vulnerable to Path Traversal via Symlink |
| GHSA-538c-55jv-c5g9 | high | onnx@1.17.0 | ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings. |
| GHSA-hqmj-h5c6-369m | high | onnx@1.17.0 | ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() - Silent Supply-Chain Attack |
| GHSA-q56x-g2fj-4rj6 | high | onnx@1.17.0 | ONNX: TOCTOU arbitrary file read/write in save_external_dat |
| GHSA-6rq9-53c3-f7vj | high | onnx@1.17.0 | |
| GHSA-7gcm-g887-7qv7 | high | protobuf@4.25.8 | protobuf affected by a JSON recursion depth bypass |
| GHSA-29pf-2h5f-8g72 | high | transformers@4.54.1 | HuggingFace transformers vulnerable to remote code execution |
| GHSA-fgcw-684q-jj6r | high | transformers@4.54.1 | huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path |
| GHSA-x9r9-c232-4q39 | high | transformers@4.54.1 | Hugging Face Transformers downloads custom generation code before trust consent |
By the numbers
| Stars | 12.6K |
|---|---|
| Forks | 1,606 |
| Contributors | 159 |
| Commits | 3,468 |
| Open issues | 529 |
| Open pull requests | 11 |
| Releases | 176 |
| Latest release | v26.0.0 |
| Licence | Apache-2.0 |
| Main language | Python |
| Project age | 3 years |
| Last push | Aug 1, 2026 |
| Tracked files | 370 |
| Lines of code | 61.5K |
| Checkout size | 4 MB |
Lines by language: Python 41.4K, JSON 8,344, Markdown 8,121, Shell 1,063, PowerShell 867, TOML 430.
Questions
Is Kohya's GUI free?
Yes. kohya_ss is free and open source under Apache-2.0. Training runs on your own GPU at no cost; cloud GPU services such as Runpod or Novita charge by the hour if you use them.
What GPU do I need to train a LoRA?
An NVIDIA card is the supported path. Small SD 1.5 LoRAs can train on modest cards with memory-saving options, while SDXL and Flux need considerably more VRAM. Without a suitable GPU, the README points to a community Colab notebook and to Runpod and Novita templates.
What is the difference between kohya_ss and sd-scripts?
sd-scripts, by Kohya, is the set of command-line training scripts. kohya_ss, by bmaltais, is the Gradio interface on top that fills in the options, builds the command and runs it, so you do not have to memorize dozens of flags.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.