SD.Next began in late 2022 as Vladimir Mandic's fork of the AUTOMATIC1111 WebUI and has since been rebuilt around Hugging Face's diffusers library. The familiar tabbed interface is still there, text to image, image to image, inpainting, outpainting, ControlNet, IP-Adapters, LoRA and a detailer, but underneath it now loads dozens of model families: SDXL and SD 3.5, Flux.1 and Flux.2 Klein, Chroma, HiDream, Qwen Image, Z-Image, Lumina and more, plus video models such as Wan and LTX. Pick a reference model from the list and it downloads itself.
What sets it apart is breadth of hardware. The installer detects the machine and sets up PyTorch for NVIDIA CUDA, AMD ROCm on Linux and Windows, ZLUDA, Intel Arc, OpenVINO, DirectML or Apple Silicon, and its SDNQ quantization and balanced offload squeeze large models into modest VRAM. It is Apache-2.0, has no tagged releases (the master branch is the release, updated most weeks), and has a desktop and a mobile interface in about 15 languages.
- Repository: github.com/vladmandic/sdnext
- Licence: Apache-2.0 (Apache License 2.0)
- Language: Python. Stars: 7,347. Forks: 585. Last push: Sep 27, 2026.
- Scan: safe, Sep 21, 2026, commit ff14b17
Who it is for
People who liked the A1111 way of working but want current models, owners of AMD, Intel or older NVIDIA cards that other UIs treat as an afterthought, and anyone who wants image and video generation in one local app.
Getting started
1. Clone the repository
git clone https://github.com/vladmandic/sdnext && cd sdnext2. Start it on Linux or macOS (webui.bat or webui.ps1 on Windows); the first run installs PyTorch for your GPU and everything else
./webui.sh3. Later, update to the latest master before starting
./webui.sh --upgradeThe interface opens on http://localhost:7860. The installer needs a recent Python 3 (3.10 still works but is no longer actively supported) and downloads several gigabytes of PyTorch and models on first use.
Safety scan
We cloned vladmandic/sdnext at commit ff14b17 on Sep 21, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- Three secret hits, all the same string in pipelines/lumina_dimmo/notes.md: the AKIA access key ID inside a GitHub-generated, pre-signed link to an image attachment, dated 11 October 2025 and valid for 300 seconds. It is GitHub's own signing credential in a pasted URL, long expired, and grants nothing. No committed binaries, no install hooks and no bare-IP URLs across about a million lines, most of them JSON model and locale data.
- One pattern hit, modules/rocm.py line 396. The os.dup2 call belongs to a mute() helper that sends stdout to the null device while the AMD HIP runtime DLL initializes on Windows, then restores it. It is not a socket or a shell.
- The scan reads this repository only. .gitmodules pins five submodules to commits: the wiki and four built-in extensions (sd-extension-chainner, sdnext-modernui, sdnext-kanvas and sdnq) from their own repositories, which the installer checks out. They are maintained by the SD.Next developers and contributors, but their code was not part of this scan.
- 22 known advisories and none critical. requirements.txt pins 22 packages that carry 16 high and 5 moderate: setuptools 69.5.1 (two issues in its legacy package-download code), urllib3 1.26.19 (decompression limits, header forwarding) and Pillow 12.2.0 (malformed-image parsing). The pnpm lockfile, 641 packages, has 1 high in js-yaml; it is ESLint, esbuild and TypeScript tooling for building the UI.
- Three workflows, all for the documentation site, none using pull_request_target; none of the four third-party actions is pinned to a commit. A security policy is present, and it states the app sends no analytics and connects out only for installs, updates, extension indexes and model downloads you ask for.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | 3 candidates found and read; see the notes above. |
| Suspicious code | 1 pattern hit found and read; every one is listed under the raw findings. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | None. |
| CI workflows | 3 workflows. None use pull_request_target. 4 of 4 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often huggingface.co, github.com, arxiv.org, www.apache.org. No URLs to bare IP addresses. |
| Known vulnerabilities | 22 advisories across 663 pinned packages: 0 critical, 17 high, 5 moderate, 0 low. pnpm-lock.yaml: 641 packages, 1 advisories; requirements.txt: 22 packages, 21 advisories. |
| Project hygiene | Has security policy, licence file. Missing automated dependency updates, CodeQL, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Secret candidates (3, redacted)
| Where | Rule | Match |
|---|---|---|
| pipelines/lumina_dimmo/notes.md:28 | aws-access-key | AKIAVC…4ZA (20 chars) |
| pipelines/lumina_dimmo/notes.md:69 | aws-access-key | AKIAVC…4ZA (20 chars) |
| pipelines/lumina_dimmo/notes.md:115 | aws-access-key | AKIAVC…4ZA (20 chars) |
Pattern hits (1)
| Where | Rule | Match |
|---|---|---|
| modules/rocm.py:396 | raw-socket-shell | os.dup2(devnull.fileno(), fd) |
Worst known vulnerabilities (22 of 22)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-2883-xcg3-v3hh | high | js-yaml@4.3.1 | js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources |
| GHSA-5rjg-fvgr-3xxf | high | setuptools@69.5.1 | setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write |
| GHSA-cx63-2mw6-8hw5 | high | setuptools@69.5.1 | setuptools vulnerable to Command Injection via package URL |
| GHSA-2xpw-w6gg-jr37 | high | urllib3@1.26.19 | urllib3 streaming API improperly handles highly compressed data |
| GHSA-38jv-5279-wg99 | high | urllib3@1.26.19 | Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) |
| GHSA-gm62-xv2j-4w53 | high | urllib3@1.26.19 | urllib3 allows an unbounded number of links in the decompression chain |
| GHSA-qccp-gfcp-xxvc | high | urllib3@1.26.19 | urllib3: Sensitive headers forwarded across origins in proxied low-level redirects |
| GHSA-45hq-cxwh-f6vc | high | pillow@12.2.0 | Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` - bomb protection bypass via font loadi… |
| GHSA-5x94-69rx-g8h2 | high | pillow@12.2.0 | Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()` |
| GHSA-62p4-gmf7-7g93 | high | pillow@12.2.0 | Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files) |
| GHSA-6r8x-57c9-28j4 | high | pillow@12.2.0 | Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow |
| GHSA-8v84-f9pq-wr9x | high | pillow@12.2.0 | Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` - bomb protection… |
| GHSA-9hw9-ch79-4vh6 | high | pillow@12.2.0 | Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch |
| GHSA-jjj6-mw9f-p565 | high | pillow@12.2.0 | Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode() |
| GHSA-phj9-mv4w-65pm | high | pillow@12.2.0 | Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()` |
| GHSA-vjc4-5qp5-m44j | high | pillow@12.2.0 | Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service |
| GHSA-xj96-63gp-2gmr | high | pillow@12.2.0 | Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand` |
| GHSA-h35f-9h28-mq5c | moderate | setuptools@69.5.1 | setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+ |
| GHSA-pq67-6m6q-mj2v | moderate | urllib3@1.26.19 | urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation |
| GHSA-4x4j-2g7c-83w6 | moderate | pillow@12.2.0 | Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path |
| GHSA-fj7v-r99m-22gq | moderate | pillow@12.2.0 | Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images |
| GHSA-pg7v-jwj7-p798 | moderate | pillow@12.2.0 | Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service |
By the numbers
| Stars | 7,347 |
|---|---|
| Forks | 585 |
| Contributors | 518 |
| Commits | 14.8K |
| Open issues | 58 |
| Open pull requests | 2 |
| Releases | 0 |
| Latest release | none tagged |
| Licence | Apache-2.0 |
| Main language | Python |
| Project age | 3 years |
| Last push | Sep 27, 2026 |
| Tracked files | 1,780 |
| Lines of code | 1M |
| Checkout size | 69 MB |
Lines by language: JSON 643.9K, Python 327.8K, CSS 17.9K, Markdown 11.4K, TypeScript 9,415, JavaScript 2,223.
Questions
Is SD.Next free?
Yes. SD.Next is Apache-2.0, free for personal and commercial use, with no paid tier, account or cloud service attached. The models it downloads carry their own licences, which range from permissive to non-commercial (some Flux weights, for example), so check the terms of each one you use for commercial work.
What is the difference between SD.Next and AUTOMATIC1111?
SD.Next started as a fork of AUTOMATIC1111 and keeps a similar tabbed interface, but it has been rewritten around the diffusers library, supports dozens of newer image and video models, and handles AMD, Intel and Apple hardware far better. AUTOMATIC1111's main branch has not changed since July 2024, while SD.Next is updated most weeks.
Does SD.Next work on AMD or Intel GPUs?
Yes, which is one of its main strengths. The installer sets up ROCm for AMD cards on Linux and Windows, with ZLUDA and DirectML as Windows alternatives, IPEX for Intel Arc, and OpenVINO for Intel CPUs and GPUs. NVIDIA through CUDA and Apple Silicon through MPS are covered too, and it can run on a CPU alone, slowly.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.