v6.13.7
📦 invokeaiView on GitHub →
🐛 4 fixes🔧 2 symbols
Summary
This is a security patch release addressing critical vulnerabilities that could expose sensitive API keys and model information. It also includes fixes for less critical security issues and privilege escalation.
Migration Steps
- Upgrade to version 6.13.7.
- Rotate your API tokens and keys if you suspect they may have been compromised.
🐛 Bug Fixes
- Fixed a security vulnerability that allowed attackers to recover the contents of `invokeai.yaml` and `api_keys.yaml` files.
- Closed security issues related to the leakage of model paths, allowing attackers to enumerate model files.
- Closed security issues related to testing the existence of arbitrary paths on the Invoke server's filesystem.
- Resolved an issue where administrator functions were available to regular users in multiuser mode.