What is the CVSS score of EUVD-2026-51402?

EUVD-2026-51402 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of ComfyUI are affected by EUVD-2026-51402?

ComfyUI installations prior to version 0.28.0 contain a stored cross-site scripting vulnerability that allows attackers to steal authentication tokens and API credentials from authorized users.. A patch is available.

How to fix or mitigate EUVD-2026-51402?

Within 24 hours, inventory all ComfyUI deployments and identify instances running versions before 0.28.0; document current versions and restrict external network access to ComfyUI web interfaces to authorized users only. Within 7 days, restrict file upload capabilities to administrators only, disable user-initiated untrusted workflow imports, and rotate all API tokens and browser credentials that may have been stored within ComfyUI instances. Within 30 days, upgrade all affected ComfyUI installations to version 0.28.0 or later (once vendor releases the patch) and resume normal user workflow capabilities only after comprehensive testing and patch deployment verification.

ComfyUI EUVD-2026-51402

| CVE-2026-56672 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-31 GitHub_M

XSS Comfyui Comfy Org

8.2

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Network-reachable POST/GET with no auth in default deployments (PR:N), requires victim to open the file URL (UI:R); same-origin execution crosses scope (S:C) enabling token theft (C:H) and API calls (I:L).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 31, 2026 - 06:15 EUVD

Source Code Evidence Fetched

Jul 31, 2026 - 05:47 vuln.today

Analysis Generated

Jul 31, 2026 - 05:47 vuln.today

CVE Published

Jul 31, 2026 - 04:27 cve.org

HIGH 8.2

DescriptionCVE.org

ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/{file} served user-controlled HTML and SVG files with extension-derived content types, allowing stored cross-site scripting in the ComfyUI origin and access to browser-stored API tokens, settings, workflows, and authenticated-equivalent API calls. The handler used web.FileResponse(path), so an uploaded .html/.svg was served as text/html/image/svg+xml. POST /userdata stores arbitrary request bodies (confined to the user's userdata directory). When a victim navigated to the file URL, the embedded script executed same-origin. The /view endpoint already forced dangerous MIME types to download; that protection had never been applied to /userdata. This issue is fixed in version 0.28.0.

AnalysisAI

Stored cross-site scripting in ComfyUI (Comfy-Org) before 0.28.0 lets an attacker upload HTML or SVG to the per-user userdata store via POST /userdata and have it served with an executable content type by GET /userdata/{file}, so a script runs in the ComfyUI origin the moment a victim opens the file URL. Because it executes same-origin, the payload can read browser-stored API tokens, settings, and workflows and issue authenticated-equivalent API calls. Rated CVSS 8.2 (High); no public exploit identified at time of analysis and it is not in CISA KEV.

Technical ContextAI

ComfyUI is a Python (aiohttp) node-based backend and web GUI for diffusion models. The flaw is CWE-79 (improper neutralization of input during web page generation) rooted in content-type handling: the /userdata GET handler used web.FileResponse(path), which derives Content-Type from the file extension, so an uploaded .html was served as text/html and an .svg as image/svg+xml - both of which browsers render and execute inline. The companion /view endpoint already forced dangerous MIME types to download, but that guard was never applied to /userdata. The fix centralizes a folder_paths.is_dangerous_content_type() check (covering text/html, image/svg+xml, JavaScript, CSS, any *+xml or */xml dialect, and message/rfc822, with charset/casing normalization) and, for /userdata, forces Content-Type to application/octet-stream, adds X-Content-Type-Options: nosniff, and sets Content-Disposition: attachment. The same commit also hardened an unrelated model-preview path-traversal/symlink escape.

RemediationAI

Vendor-released patch: upgrade to ComfyUI 0.28.0 or later, which forces user-controlled userdata files to download with Content-Disposition: attachment, X-Content-Type-Options: nosniff, and a neutralized application/octet-stream content type (see the release at https://github.com/Comfy-Org/ComfyUI/releases/tag/v0.28.0 and advisory GHSA-53g8-45wq-pcv8). If you cannot upgrade immediately, place ComfyUI behind a reverse proxy that strips inline rendering by adding Content-Disposition: attachment and X-Content-Type-Options: nosniff to responses from /userdata (accepting that legitimately previewable userdata files will now download instead of render), restrict network access to the ComfyUI port to trusted operators only, and require authentication in front of the /userdata POST/GET endpoints so untrusted parties cannot write or serve files. Avoid opening /userdata file URLs received from untrusted sources until patched.