InvokeAI Security Patch Fixes Critical RCE and SSRF Flaws in Emergency Release

The popular open-source image generator InvokeAI has issued an emergency security release, version 6.13.8, to patch two severe security vulnerabilities that put self-hosted environments at risk. The critical InvokeAI security patch addresses flaws that allow remote attackers to execute arbitrary code and manipulate local network connections, affecting all installations up to version 6.13.7.

Understanding the Critical InvokeAI Security Patch

Local, self-hosted generative AI tools have exploded in popularity as developers and artists seek to bypass corporate API limitations and maintain data privacy. However, running complex, stateful machine learning pipelines locally introduces a massive attack surface. The latest InvokeAI release highlights the growing pains of this ecosystem, patching two vulnerabilities that could allow malicious actors to compromise host machines or pivot into internal enterprise networks.

The update was rushed out after independent security researchers Abhinash Singh and Arpit Jain discovered and reported a critical directory traversal and file write vector. Users running any instance exposed to the internet or untrusted local networks are urged to upgrade immediately.

Inside the Exploits: Arbitrary Code Execution and SSRF

The first and most severe vulnerability patched in version 6.13.8 involves an arbitrary file write mechanism. An attacker can craft a malicious URL payload that targets the server's custom nodes directory. By exploiting this flaw, the attacker can overwrite existing files or write new scripts directly into the directory where InvokeAI loads its extensions.

Because InvokeAI automatically loads and executes scripts from its custom nodes directory on startup, this vulnerability effectively grants attackers Remote Code Execution (RCE). On Windows-based systems, the exploit is even more dangerous: an attacker can place arbitrary files anywhere on the local filesystem that the server process has permissions to access.

The second vulnerability patched in this release is a Server-Side Request Forgery (SSRF) flaw. This bug allows an attacker to trick the active InvokeAI server into initiating outbound network connections to arbitrary external servers or, more dangerously, internal devices on the local area network (LAN). This could allow malicious actors to scan internal infrastructure, bypass local firewalls, or exploit unauthenticated services running inside the user's private network.

The Hidden Risks of Self-Hosted Generative AI

This incident underscores a broader trend in the open-source AI community: security is lagging behind feature development. While enterprise software platforms undergo rigorous penetration testing and secure development lifecycle audits, many open-source AI interfaces are built at breakneck speed by community contributors focused primarily on raw performance and model compatibility.

An attacker can craft a URL payload that overwrites files in the server's custom nodes directory, allowing for execution of arbitrary code on the next startup.

InvokeAI Security Advisory

Custom node ecosystems, which are heavily utilized in platforms like InvokeAI and ComfyUI, represent a particularly soft target. Because these systems are designed to easily import third-party code to expand UI and generation capabilities, they frequently run with the same system privileges as the main application. If the core application fails to properly sanitize inputs and file paths, it creates a direct path to total system compromise.

Immediate Action Required: How to Secure Your Setup

If you run InvokeAI on a local machine, a dedicated home server, or a cloud instance, you should treat this security advisory with high priority. To mitigate the risks, users should execute the following steps immediately:

• Upgrade to v6.13.8: Pull the latest changes from the official GitHub repository or run the built-in updater to ensure the patches are applied.
• Restrict Network Exposure: Avoid exposing local AI web interfaces directly to the public internet. Use VPNs or secure tunnels (like Tailscale) if remote access is required.
• Audit Permissions: Ensure the user account running the InvokeAI process does not have administrative or root privileges, limiting the damage an arbitrary file-write exploit can cause.

The Takeaway

As AI tools transition from experimental playthings to critical pipeline infrastructure for creators and enterprises alike, security can no longer be an afterthought. The InvokeAI security patch serves as a stark reminder that self-hosting your AI stack means taking full responsibility for its defense-in-depth.