How to fix or mitigate EUVD-2025-18346?

Within 30 days: Identify affected systems running comfyanonymous comfyui and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

EUVD-2025-18346

Q: What is the CVSS score of EUVD-2025-18346?

EUVD-2025-18346 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2025-6092 LOW

Cross-site Scripting (XSS) (CWE-79)

2025-06-15 cna@vuldb.com

XSS

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 14, 2026 - 21:57 euvd

EUVD-2025-18346

Analysis Generated

Mar 14, 2026 - 21:57 vuln.today

CVE Published

Jun 15, 2025 - 18:15 nvd

MEDIUM 4.3

DescriptionCVE.org

A vulnerability was found in comfyanonymous comfyui up to 0.3.39. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /upload/image of the component Incomplete Fix CVE-2024-10099. The manipulation of the argument image leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stored cross‑site scripting in ComfyUI’s /upload/image endpoint allows unauthenticated, remote attackers to inject arbitrary web scripts by uploading a crafted image. The flaw exists in all versions up to 0.3.39 and is an incomplete fix of CVE‑2024‑10099. Public exploit code is available, though no active exploitation has been reported.