InvokeAI 6.13.8 fixes two flaws in its model-download system

InvokeAI 6.13.8 was published on August 13 at 21:35 UTC, or August 14 at 00:35 in Romania. According to the maintainers, a crafted URL could cause the server to overwrite files in the custom-nodes directory. A file placed there could be loaded on the next startup, turning arbitrary file writing into a potential path to code execution. On Windows, the write scope could extend to other locations accessible to the server process.

A second issue allowed the server to contact services on the local network, the public Internet or private address ranges, a form of server-side request forgery. The patch restricts download destinations, validates redirects and filenames, and adds safeguards against private addresses and DNS rebinding; the affected REST route was removed. The release provides no CVE, CVSS score or evidence of active exploitation.

‘Running locally’ does not automatically mean ‘isolated.’ In a studio that exposes InvokeAI to multiple users, nodes or services, model downloading becomes part of the attack surface—especially on workstations holding client projects, credentials or mounted network volumes. This should be treated as security maintenance, but the patch does not prove any installation was compromised.

We are watching for a CVE, CVSS score or full advisory, confirmation of whether exploitation occurred, possible backports and official guidance for inspecting installations and custom nodes. Studios should update from an authenticated source and review exposure rather than assuming every local instance was reachable.