automatic1111/stable-diffusion-webui
Stable Diffusion web UI
How stable-diffusion-webui is put together
Stable Diffusion web UI is a Python application providing a browser-based interface for running Stable Diffusion image generation models, built on the Gradio library with a FastAPI backend. It is organized as a large collection of modules under `modules/` that handle model loading, sampling, image processing, UI construction, and an optional REST API, complemented by browser-side JavaScript in `javascript/` for UI behavior. Data flows from user prompts and images through the Gradio UI (or API) into processing pipelines that load checkpoints, run samplers over the diffusion model, and return generated images with embedded generation metadata. It supports extensions, textual inversion, hypernetworks/LoRAs, face restoration, and upscalers, and can optionally expose arbitrary code execution and ngrok tunneling.
Languages
Frameworks
Datastores
Infrastructure
Major components
modules (core backend)
Main Python package implementing model loading, sampling, processing pipelines, options, and shared state.
SD model management (sd_models*, sd_vae*, sd_hijack*)
Loads/merges checkpoints, detects model configs from state dicts, manages VAEs, and hijacks/optimizes the underlying diffusion model.
Samplers (sd_samplers*)
Implements the various diffusion sampling methods (k-diffusion, timesteps, LCM, CFG denoiser) used during generation.
UI (modules/ui*.py + javascript/)
Builds the Gradio interface (txt2img, img2img, extras, settings, extensions, extra networks) with browser-side JS enhancements.
Processing pipelines (processing.py, txt2img.py, img2img.py, postprocessing.py)
Orchestrates the end-to-end image generation and post-processing flows from prompt/image input to output.
Extensions & scripts system
Discovers, loads, and manages community extensions and custom scripts including config state save/restore.
Upscalers & face restoration
Integrates ESRGAN/RealESRGAN/DAT/HAT/SwinIR upscalers and GFPGAN/CodeFormer face restoration models.
Launch & initialization (launch.py, webui.py, initialize*.py, launch_utils.py)
Handles dependency installation, environment setup, argument parsing, and application bootstrap.
No digest this week
1 weeksWeek of
Dependencies and code review
Dependency advisories
Security Watch
3 vulnerable packages (28 advisories) across 5 scanned dependencies.
gradio 3.41.2
18 advisories. Fixed in 5.0.0.
- highGHSA-279j-x4gx-hfrhGradio uses insecure communication between the FRP client and server
- highGHSA-39mp-8hj3-5c49Gradio is Vulnerable to Absolute Path Traversal on Windows with Python 3.13+
- highGHSA-3c67-5hwx-f6wxGradios's CORS origin validation is not performed when the request has a cookie
- highGHSA-5cpq-9538-jm2jGradio DOS in multipart boundry while uploading the file
- highGHSA-6qm2-wpxq-7qh2Gradio makes the `/file` secure against file traversal and server-side request forgery attacks
- highGHSA-6v6g-j5fq-hpvwLocal file inclusion in gradio
- highGHSA-7hp7-4p35-3cx2Gradio contains a cookie injection vulnerability
- highGHSA-8c87-gvhj-xm8mGradio lacks integrity checking on the downloaded FRP client
- highGHSA-973g-55hp-3frwServer-Side Request Forgery in gradio
- highGHSA-f3h9-8phc-6gvhGradio Path Traversal vulnerability
- highGHSA-g9cj-cfpp-4g2xgradio vulnerable to Path Traversal
- criticalGHSA-gqvf-3hgp-5hxvGradio Exposure of Sensitive Information to an Unauthorized Actor vulnerability
- criticalGHSA-j2jg-fq62-7c3hGradio Blocked Path ACL Bypass Vulnerability
- highGHSA-jmh7-g254-2cq9Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing
- criticalGHSA-m842-4qm8-7gpqGradio allows users to access arbitrary files
- highGHSA-r364-m2j9-mf4hgradio Server-Side Request Forgery vulnerability
- highGHSA-rvfh-h6c7-fc3cGradio allows credential leakage on Windows
- highGHSA-xh2x-3mrm-fwqmGradio has a race condition in update_root_in_config may redirect user traffic
transformers 4.30.2
7 advisories. Fixed in 5.3.0.
- highGHSA-29pf-2h5f-8g72HuggingFace transformers vulnerable to remote code execution
- criticalGHSA-3863-2447-669ptransformers has a Deserialization of Untrusted Data vulnerability
- highGHSA-fgcw-684q-jj6rhuggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path
- highGHSA-hxxf-235m-72v3Deserialization of Untrusted Data in Hugging Face Transformers
- highGHSA-qxrp-vhvm-j765Deserialization of Untrusted Data in Hugging Face Transformers
- highGHSA-v68g-wm8c-6x7jtransformers has a Deserialization of Untrusted Data vulnerability
- highGHSA-wrfc-pvp9-mr9gDeserialization of Untrusted Data in Hugging Face Transformers
protobuf 3.20.0
3 advisories. Fixed in 6.33.5.
- highGHSA-7gcm-g887-7qv7protobuf affected by a JSON recursion depth bypass
- highGHSA-8gq9-2x98-w8hfprotobuf-cpp and protobuf-python have potential Denial of Service issue
- highGHSA-8qvm-5x2c-j2w7protobuf-python has a potential Denial of Service issue
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required