ComfyUI Segment Anything CVE-2026-108962

Exploitation requires the victim to load an attacker-controlled GroundingDINO model/config file that is processed by SLConfig._file2dict, which evaluates the config file's contents as Python code - so the concrete prerequisite is getting a crafted config into the model-loading path (e.g., via a shared workflow, downloaded model bundle, or supplied config argument). Limiting factors: exploitation depends on user interaction (the victim must initiate loading of the malicious config, UI:P), there is no network service listening for unauthenticated attackers despite PR:N, and impact is confined to the environment running the comfyui_segment_anything node rather than any remote scope change.

This is a code-injection flaw (CWE-94) in the SLConfig._file2dict routine of storyicon's comfyui_segment_anything custom node, a pattern inherited from GroundingDINO/mmcv-style config loaders that evaluate config-file contents as Python. The only severity signal present is a single-source VulDB CVSS 4.0 base score of 5.3 (medium); there is no EPSS score, no CISA KEV listing, and no indication of public exploit code in the provided data, so by the precision rules this is 'no public exploit identified at time of analysis.' The supplied vector (AV:N/AC:L/PR:N/UI:P/VC:L/VI:L/VA:L) is internally tense: it marks the flaw unauthenticated and network-reachable yet rates impact as only Low/Low/Low, which understates a code-injection primitive that normally yields full arbitrary code execution on the host running ComfyUI - the impact metrics and the CWE conflict, and I weight the CWE more heavily. Critically, exploitation is gated by user interaction (UI:P) because a victim must load an attacker-crafted model/config file, which makes this a targeted, social-engineering-dependent issue rather than a mass-exploitable remote RCE. Net: real but conditional priority - treat as a supply-chain/untrusted-config risk for the small population running this node, not a drop-everything internet-facing emergency. Key gaps: no affected/fixed version (rolling release), no vendor response, and single-source reporting - verify independently before acting on the CVSS numbers.

An attacker distributes a malicious GroundingDINO configuration file (e.g., bundled with a shared ComfyUI workflow, model pack, or 'community node config'), and a victim loads it through the segment-anything node. When SLConfig._file2dict parses the config, embedded Python is evaluated and the attacker's code runs in the victim's ComfyUI process. No public exploit was identified in the provided data, but the pattern is trivially weaponizable and exploitation hinges on the victim choosing to load the crafted config (UI:P).