ComfyUI CVE-2026-56670

Exploitation requires that the attacker can upload a file (an SVG or other XML/HTML dialect) to a ComfyUI instance running a version prior to 0.28.0, and that a victim subsequently opens or views that stored file via the /view endpoint (this is the UI:R user interaction). The attack is enabled specifically because image/svg+xml and related XML content types were missing from the dangerous-MIME set, so the file is served inline rather than as a download. Limiting factors: victim interaction is mandatory (the payload does not fire automatically), the attacker needs a reachable instance that accepts uploads, and impact is greatest on shared/multi-user or internet-exposed deployments - a single-user localhost-only instance sharply reduces who can be targeted.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, base 8.2 High) reflects a network-reachable, low-complexity, unauthenticated stored XSS whose exploitation requires victim interaction (opening the crafted file) and whose scope change captures execution crossing from server-served content into the victim's browser context. EPSS was not provided and KEV status is negative, and no POC is referenced, so real-world exploitation pressure appears low-to-moderate and opportunistic rather than mass-automated. A meaningful limiting factor absent from the raw score is deployment reality: ComfyUI is frequently run as a single-user local tool on localhost, in which case the practical attack surface is small; risk rises sharply for shared, multi-user, or internet-exposed instances where one user can upload content another user views. Treat this as a genuine priority for any team running ComfyUI on a shared or exposed origin, and as lower urgency for isolated single-operator localhost use.

An attacker with access to a shared or exposed ComfyUI instance uploads an SVG file containing an embedded <script> payload, which the /view endpoint serves inline as image/svg+xml. When another operator (or an admin) opens or previews that file, the script executes in the ComfyUI origin, letting the attacker steal session context, invoke backend APIs, or pivot within the interface. No public POC is referenced, and the low attack complexity is offset by the required victim interaction.