Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

invoke-ai/InvokeAI

              main @ f3a8e95
            

Fixes

CVEs

CRITICAL

Peak severity

20.0%

Coverage

Highlights

Denial of Service: 19 prior fixes. Scrutinize any change in this area.

invokeai/app/services/session_processor/session_processor_default.py: most-fixed (3 issues). Treat as high-risk during review.

28 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: Unsafe deserialization of model files via torch.load is a critical and recurring risk, with multiple fixes and a published CVE (CVE-2024-12029). Attackers can embed malicious code in model files to achieve RCE.

Auth Bypass: Multiple authorization bypasses across API routers and invocation nodes, often due to missing ownership checks on user-scoped resources like boards, images, and system prompts. This is the most frequent vulnerability class.

Path Traversal: Path traversal vulnerabilities are prevalent in file serving and download endpoints, allowing attackers to read or delete arbitrary files. Published CVE-2025-6237 and CVE-2024-11042 highlight the severity.