ComfyUI CVE-2026-68771

Exploitation requires that the target run ComfyUI 0.23.0 or earlier with its HTTP API network-reachable to the attacker, and that both the unauthenticated POST /upload/image and POST /prompt endpoints be accessible (their default, out-of-the-box state). The attacker must upload a crafted shard_*.pkl file and queue a workflow graph that invokes the LoadTrainingDataset node against that file so torch.load deserializes it. No authentication, credentials, or user interaction is needed (PR:N/UI:N). The principal limiting factor is network exposure: ComfyUI is often deployed as a localhost/LAN-only service, so instances bound to loopback or behind an authenticating proxy/VPN are not remotely exploitable; a build containing commit 94ee49b (weights_only=True) is also not vulnerable.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) aligns fully with the description: network-reachable, low complexity, no privileges, no user interaction, full confidentiality/integrity/availability impact on the vulnerable system. Deserialization RCE via pickle is a well-understood, reliable, automatable exploitation class, so real-world exploitability is high once an instance is exposed. The main mitigating factor is exposure rather than difficulty: ComfyUI is typically run as a local or LAN service, so internet-exposed instances are the primary risk surface. No EPSS score, KEV listing, or public POC was provided; the absence of KEV/EPSS data means widespread active exploitation cannot be confirmed, but the low technical bar warrants prompt patching for any exposed deployment.

An attacker locates an internet- or LAN-exposed ComfyUI instance and sends an unauthenticated POST /upload/image request carrying a malicious shard_*.pkl whose pickle __reduce__ payload runs os.system with attacker commands. They then POST /prompt with a workflow graph referencing the uploaded file through the LoadTrainingDataset node; when torch.load deserializes it, arbitrary code executes as the ComfyUI process user. No public POC is identified, but the pickle __reduce__ technique is trivial and reliable to construct.