What is the CVSS score of CVE-2026-56670?

CVE-2026-56670 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of ComfyUI are affected by CVE-2026-56670?

ComfyUI, an image generation platform used for AI model inference workflows, is vulnerable to stored cross-site scripting (CVE-2026-56670) that executes arbitrary JavaScript in user browsers with…. A patch is available.

How to fix or mitigate CVE-2026-56670?

Within 24 hours, inventory all ComfyUI deployments and document current versions, then implement immediate upload restrictions on SVG and XML content types pending remediation. Within 7 days, upgrade all ComfyUI instances to version 0.28.0 or later and verify successful deployment across all environments. Within 30 days, audit uploaded files from before the patch date for suspicious SVG content, review user access logs for anomalous activity during the vulnerability window, and confirm no malicious files remain in production systems.

ComfyUI CVE-2026-56670

EUVD-2026-51400 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-31 GitHub_M

XSS Comfyui Comfy Org

8.2

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Network-reachable unauthenticated upload with no auth by default (PR:N), victim must open the file (UI:R), and script executing across origin into the browser justifies S:C with C:H/I:L.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 31, 2026 - 06:15 EUVD

Source Code Evidence Fetched

Jul 31, 2026 - 05:46 vuln.today

Analysis Generated

Jul 31, 2026 - 05:46 vuln.today

CVE Published

Jul 31, 2026 - 04:17 cve.org

HIGH 8.2

DescriptionCVE.org

ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, the /view endpoint served uploaded SVG files inline because image/svg+xml and related XML content types were absent from the dangerous-content-type handling, allowing stored cross-site scripting in the ComfyUI origin. This issue is fixed in version 0.28.0.

AnalysisAI

Stored cross-site scripting in ComfyUI before 0.28.0 lets an attacker upload a malicious SVG that the /view endpoint serves inline in the application origin, executing arbitrary JavaScript in the browser of any user who opens it. Because image/svg+xml and related XML content types were missing from the dangerous-content-type list, uploaded markup rendered instead of downloading; a victim viewing the file triggers script that runs with full access to the ComfyUI session. No public exploit was identified at time of analysis and it is not listed in CISA KEV, but the fix commit and released version 0.28.0 are confirmed by the vendor advisory.

Technical ContextAI

ComfyUI is a Python (aiohttp/web) node-based GUI and backend for running diffusion image-generation models, with file endpoints (/view, /userdata, asset download) that serve user-uploaded content. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the handler maintained a hardcoded set of 'dangerous' MIME types (text/html, application/xhtml+xml, text/javascript, text/css) that omitted image/svg+xml, application/xml, text/xml and other XML dialects. SVG is an XML document that can carry inline <script> and event handlers, so when served with Content-Type: image/svg+xml and inline disposition, browsers execute it in the serving origin. The fix centralizes detection in folder_paths.is_dangerous_content_type(), which normalizes charset/casing parameters and treats any *+xml or */xml type as dangerous, then forces Content-Disposition: attachment, Content-Type override to application/octet-stream, and X-Content-Type-Options: nosniff across /view and /userdata. CPE cpe:2.3:a:comfy-org:comfyui:*:*:*:*:*:*:*:* identifies the affected product.

RemediationAI

Upgrade to ComfyUI 0.28.0 or later, which is the vendor-released patch that centralizes dangerous-content-type handling and forces uploaded SVG/HTML/XML to download with Content-Disposition: attachment and X-Content-Type-Options: nosniff (advisory GHSA-rj8c-c4p8-3c5h; release https://github.com/Comfy-Org/ComfyUI/releases/tag/v0.28.0; commit 96e0e3585b41e1417442eaa14ec57f7b4ffcb5e0). If immediate patching is not possible, restrict who can reach and upload to the instance by binding ComfyUI to localhost or placing it behind an authenticating reverse proxy, and do not expose it to untrusted or multi-user networks; as a compensating control, front the /view and /userdata endpoints with a proxy that rewrites Content-Type to application/octet-stream and adds Content-Disposition: attachment plus X-Content-Type-Options: nosniff for user-served files. The trade-off of forcing downloads is that any legitimately inline-rendered user content will now download instead of displaying, and restricting to localhost removes remote/multi-user access entirely.