EUVD-2026-23739
GHSA-643x-95vv-2wf6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
9DescriptionCVE.org
A vulnerability was found in ComfyUI up to 0.13.0. Affected by this issue is some unknown functionality of the file server.py of the component View Endpoint. Performing a manipulation results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Cross-site scripting (XSS) in ComfyUI up to version 0.13.0 allows authenticated remote attackers to inject malicious scripts through the View Endpoint in server.py, affecting user integrity with publicly available exploit code. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting its severity despite network accessibility. ComfyUI's vendor has not responded to early disclosure attempts, and the exploit has been published on GitHub, making this a low-CVSS but publicly weaponized vulnerability affecting an AI image generation framework.
Technical ContextAI
ComfyUI is a node-based UI for Stable Diffusion that provides a web-based server interface (server.py). The vulnerability exists in the View Endpoint component, which handles HTTP requests and responses. The root cause is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating insufficient input sanitization or output encoding. The attacker can manipulate parameters or data passed to the View Endpoint, causing unsanitized content to be reflected or stored in the HTML response. When a victim user views the affected page in their browser, the injected JavaScript executes in their security context, potentially allowing session hijacking, credential theft, or actions performed on behalf of the victim user within the ComfyUI application.
RemediationAI
No vendor-released patch has been identified at time of analysis, as ComfyUI's maintainers did not respond to early disclosure. Immediate mitigations include: (1) Upgrade to a version newer than 0.13.0 if available (check the ComfyUI GitHub repository for releases post-disclosure); (2) If upgrade is not possible, restrict network access to the ComfyUI server by placing it behind a reverse proxy or firewall that only allows trusted IP addresses, reducing the attack surface despite the NV:N vector; (3) Implement strict input validation and output encoding in server.py's View Endpoint by escaping or sanitizing all user-supplied input before rendering it in HTML responses (e.g., using HTML entity encoding for user input); (4) Disable or restrict access to the View Endpoint feature if it is non-critical to your workflow; (5) Run ComfyUI in single-user mode or trusted environments only, eliminating the multi-user attack scenario where one user's script could affect another's session. Trade-offs: Network restriction may impact remote access usability; disabling the View Endpoint may limit functionality; patching server.py requires code modification skills and testing. Monitor the ComfyUI GitHub repository and VulDB for vendor updates.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today