ComfyUI EUVD-2026-51402

Requires (1) the ability to write a file via POST /userdata - in a default no-auth ComfyUI deployment this is any network-reachable party, but an authenticated or proxied deployment limits it to users who can write to a userdata directory; (2) an uploaded file with an executable extension (.html, .svg, or other dangerous MIME dialects such as *+xml) since the pre-0.28.0 handler derived Content-Type from the extension via web.FileResponse; and (3) user interaction - a victim must actively navigate to the GET /userdata/{file} URL in a browser sharing the ComfyUI origin/session. Exploitation is limited by that mandatory victim click (UI:R), by any authentication placed in front of /userdata, and it does not apply to instances already on 0.28.0 where dangerous types are forced to download.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, 8.2) describes a network-reachable, low-complexity, no-privilege attack that requires victim interaction (opening the malicious file URL) and results in a scope change with high confidentiality impact - consistent with same-origin token theft. There is no EPSS score, no KEV listing, and no POC in the supplied data, so real-world exploitation pressure is currently low-to-unknown despite the high base score. The PR:N rating assumes the common default ComfyUI deployment with no authentication in front of /userdata; in a multi-user or auth-gated deployment the attacker would need the ability to write to a userdata directory, raising the practical bar. Net: a genuine, well-understood stored-XSS priority for any internet- or LAN-exposed ComfyUI instance, but the requirement that a victim navigate to the attacker's file (UI:R) makes it a targeted/social-engineering vector rather than a wormable mass-exploitation risk.

An attacker who can reach the ComfyUI web API sends POST /userdata storing a small .html or .svg file containing JavaScript, then delivers the resulting GET /userdata/{file} URL to an operator (e.g., via chat or a workflow share). When the victim opens the link in the same browser session used for ComfyUI, the script runs in the ComfyUI origin and exfiltrates browser-stored API tokens and settings or drives authenticated-equivalent API calls. No public POC is identified, and the AC:L/UI:R profile means the only real hurdle is convincing the victim to click the link.