EUVD-2026-23731Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionCVE.org
A security vulnerability has been detected in ComfyUI up to 0.13.0. This affects the function create_origin_only_middleware of the file server.py. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Cross-site request forgery (CSRF) in ComfyUI up to version 0.13.0 allows unauthenticated remote attackers to modify application state via crafted requests to the create_origin_only_middleware function in server.py. The vulnerability requires user interaction (clicking a malicious link or visiting an attacker-controlled site) but has low integrity impact and is publicly exploitable with proof-of-concept code available. The vendor has not responded to early disclosure notification.
Technical ContextAI
ComfyUI is a node-based UI for Stable Diffusion and other generative AI models. The vulnerability resides in the create_origin_only_middleware function within server.py, which is responsible for managing cross-origin request policies. The root cause is classified under CWE-352 (Cross-Site Request Forgery), indicating insufficient CSRF token validation or origin verification when processing state-modifying requests. The CVSS vector AV:N/AC:L/PR:N/UI:R indicates the flaw is exploitable over the network without authentication but requires user interaction (UI:R), such as clicking a malicious link while authenticated to ComfyUI. The affected CPE encompasses all versions of ComfyUI up to and including 0.13.0.
RemediationAI
Upgrade ComfyUI to a version released after the disclosure; however, no specific patched version number is confirmed in available data due to lack of vendor response. Until an official patch is available, apply these compensating controls: (1) Implement strict Content Security Policy (CSP) headers restricting frame-ancestors and preventing cross-site framing, which mitigates CSRF by reducing the attack surface; (2) Configure SameSite=Strict cookies for all session tokens to prevent cookie transmission in cross-site requests, though this may affect legitimate cross-domain workflows; (3) Restrict ComfyUI access to authenticated users only and use a WAF or reverse proxy to enforce origin whitelisting, explicitly rejecting requests from untrusted origins; (4) Deploy ComfyUI behind a CSRF token validation layer (e.g., nginx module or reverse proxy middleware) that enforces token verification on all state-modifying requests (POST/PUT/DELETE). Monitor the VulDB advisory and ComfyUI GitHub repository for patch announcements. Contact the ComfyUI maintainers directly via GitHub issues if patch status remains unclear.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today