EUVD-2026-51402Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Network-reachable POST/GET with no auth in default deployments (PR:N), requires victim to open the file URL (UI:R); same-origin execution crosses scope (S:C) enabling token theft (C:H) and API calls (I:L).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/{file} served user-controlled HTML and SVG files with extension-derived content types, allowing stored cross-site scripting in the ComfyUI origin and access to browser-stored API tokens, settings, workflows, and authenticated-equivalent API calls. The handler used web.FileResponse(path), so an uploaded .html/.svg was served as text/html/image/svg+xml. POST /userdata stores arbitrary request bodies (confined to the user's userdata directory). When a victim navigated to the file URL, the embedded script executed same-origin. The /view endpoint already forced dangerous MIME types to download; that protection had never been applied to /userdata. This issue is fixed in version 0.28.0.
AnalysisAI
Stored cross-site scripting in ComfyUI (Comfy-Org) before 0.28.0 lets an attacker upload HTML or SVG to the per-user userdata store via POST /userdata and have it served with an executable content type by GET /userdata/{file}, so a script runs in the ComfyUI origin the moment a victim opens the file URL. Because it executes same-origin, the payload can read browser-stored API tokens, settings, and workflows and issue authenticated-equivalent API calls. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (1) the ability to write a file via POST /userdata - in a default no-auth ComfyUI deployment this is any network-reachable party, but an authenticated or proxied deployment limits it to users who can write to a userdata directory; (2) an uploaded file with an executable extension (.html, .svg, or other dangerous MIME dialects such as *+xml) since the pre-0.28.0 handler derived Content-Type from the extension via web.FileResponse; and (3) user interaction - a victim must actively navigate to the GET /userdata/{file} URL in a browser sharing the ComfyUI origin/session. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, 8.2) describes a network-reachable, low-complexity, no-privilege attack that requires victim interaction (opening the malicious file URL) and results in a scope change with high confidentiality impact - consistent with same-origin token theft. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the ComfyUI web API sends POST /userdata storing a small .html or .svg file containing JavaScript, then delivers the resulting GET /userdata/{file} URL to an operator (e.g., via chat or a workflow share). When the victim opens the link in the same browser session used for ComfyUI, the script runs in the ComfyUI origin and exfiltrates browser-stored API tokens and settings or drives authenticated-equivalent API calls. … |
| Remediation | Vendor-released patch: upgrade to ComfyUI 0.28.0 or later, which forces user-controlled userdata files to download with Content-Disposition: attachment, X-Content-Type-Options: nosniff, and a neutralized application/octet-stream content type (see the release at https://github.com/Comfy-Org/ComfyUI/releases/tag/v0.28.0 and advisory GHSA-53g8-45wq-pcv8). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all ComfyUI deployments and identify instances running versions before 0.28.0; document current versions and restrict external network access to ComfyUI web interfaces to authorized users only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
comfyanonymous/comfyui version v0.2.4 suffers from a non-blind Server-Side Request Forgery (SSRF) vulnerability. Rated h
A stored cross-site scripting (XSS) vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier. R
Remote code execution in ComfyUI v0.23.0 (and all prior 0.x releases) lets unauthenticated attackers run arbitrary Pytho
Stored cross-site scripting in ComfyUI before 0.28.0 lets an attacker upload a malicious SVG that the /view endpoint ser
Unauthenticated information disclosure in ComfyUI (comfy-org/comfyui) before 0.28.0 lets remote attackers read arbitrary
Path traversal arbitrary file read in ComfyUI (comfy-org) before 0.28.0 lets remote unauthenticated attackers probe arbi
Path traversal in ComfyUI up to version 0.13.0 allows authenticated remote attackers to read arbitrary files on the serv
Path traversal in ComfyUI up to version 0.13.0 allows authenticated remote attackers to read arbitrary files via manipul
Cross-site request forgery (CSRF) in ComfyUI up to version 0.13.0 allows unauthenticated remote attackers to modify appl
Cross-site scripting (XSS) in ComfyUI up to version 0.13.0 allows authenticated remote attackers to inject malicious scr
Stored cross-site scripting (XSS) in ComfyUI's userdata endpoint (getuserdata function in app/user_manager.py) allows au
A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2. Rated medium severity (CVSS 6.5), this vuln
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today