Comfy Org
Monthly
Remote code execution in ComfyUI v0.23.0 (and all prior 0.x releases) lets unauthenticated attackers run arbitrary Python by abandoning the LoadTrainingDataset node to torch.load a malicious pickle. Because the upload and prompt-queue endpoints require no authentication, an attacker who can reach the web interface can upload a crafted shard_*.pkl file and trigger deserialization to execute commands as the ComfyUI process user. VulnCheck reported the flaw and a vendor fix exists; there is no public exploit identified at time of analysis, though the technique (pickle __reduce__ abuse) is trivial to reproduce.
Path traversal arbitrary file read in ComfyUI (comfy-org) before 0.28.0 lets remote unauthenticated attackers probe arbitrary host filesystem paths and exfiltrate image-format files via the /view endpoint. A crafted POST /prompt workflow using LoadImage or sibling loader nodes joins attacker-controlled annotated filenames to a base directory with no containment check, and LoadImage's VALIDATE_INPUTS method causes the engine to skip input-directory validation. Rated CVSS 7.5 (confidentiality-only); no public exploit identified at time of analysis and it is not on CISA KEV.
Stored cross-site scripting in ComfyUI (Comfy-Org) before 0.28.0 lets an attacker upload HTML or SVG to the per-user userdata store via POST /userdata and have it served with an executable content type by GET /userdata/{file}, so a script runs in the ComfyUI origin the moment a victim opens the file URL. Because it executes same-origin, the payload can read browser-stored API tokens, settings, and workflows and issue authenticated-equivalent API calls. Rated CVSS 8.2 (High); no public exploit identified at time of analysis and it is not in CISA KEV.
Unauthenticated information disclosure in ComfyUI (comfy-org/comfyui) before 0.28.0 lets remote attackers read arbitrary image-decodable files and enumerate the host filesystem via the get_model_preview endpoint, which joins an unrestricted {filename:.*} route capture to the model directory with no containment check (CWE-22). Attackers can use literal ../, percent-encoded %2e%2e%2f, absolute paths, or an unbounded path_index to escape the model folder; disclosure is bounded to files Pillow can decode plus a file-existence/path-enumeration oracle. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the issue is fixed in version 0.28.0.
Stored cross-site scripting in ComfyUI before 0.28.0 lets an attacker upload a malicious SVG that the /view endpoint serves inline in the application origin, executing arbitrary JavaScript in the browser of any user who opens it. Because image/svg+xml and related XML content types were missing from the dangerous-content-type list, uploaded markup rendered instead of downloading; a victim viewing the file triggers script that runs with full access to the ComfyUI session. No public exploit was identified at time of analysis and it is not listed in CISA KEV, but the fix commit and released version 0.28.0 are confirmed by the vendor advisory.
Remote code execution in ComfyUI v0.23.0 (and all prior 0.x releases) lets unauthenticated attackers run arbitrary Python by abandoning the LoadTrainingDataset node to torch.load a malicious pickle. Because the upload and prompt-queue endpoints require no authentication, an attacker who can reach the web interface can upload a crafted shard_*.pkl file and trigger deserialization to execute commands as the ComfyUI process user. VulnCheck reported the flaw and a vendor fix exists; there is no public exploit identified at time of analysis, though the technique (pickle __reduce__ abuse) is trivial to reproduce.
Path traversal arbitrary file read in ComfyUI (comfy-org) before 0.28.0 lets remote unauthenticated attackers probe arbitrary host filesystem paths and exfiltrate image-format files via the /view endpoint. A crafted POST /prompt workflow using LoadImage or sibling loader nodes joins attacker-controlled annotated filenames to a base directory with no containment check, and LoadImage's VALIDATE_INPUTS method causes the engine to skip input-directory validation. Rated CVSS 7.5 (confidentiality-only); no public exploit identified at time of analysis and it is not on CISA KEV.
Stored cross-site scripting in ComfyUI (Comfy-Org) before 0.28.0 lets an attacker upload HTML or SVG to the per-user userdata store via POST /userdata and have it served with an executable content type by GET /userdata/{file}, so a script runs in the ComfyUI origin the moment a victim opens the file URL. Because it executes same-origin, the payload can read browser-stored API tokens, settings, and workflows and issue authenticated-equivalent API calls. Rated CVSS 8.2 (High); no public exploit identified at time of analysis and it is not in CISA KEV.
Unauthenticated information disclosure in ComfyUI (comfy-org/comfyui) before 0.28.0 lets remote attackers read arbitrary image-decodable files and enumerate the host filesystem via the get_model_preview endpoint, which joins an unrestricted {filename:.*} route capture to the model directory with no containment check (CWE-22). Attackers can use literal ../, percent-encoded %2e%2e%2f, absolute paths, or an unbounded path_index to escape the model folder; disclosure is bounded to files Pillow can decode plus a file-existence/path-enumeration oracle. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the issue is fixed in version 0.28.0.
Stored cross-site scripting in ComfyUI before 0.28.0 lets an attacker upload a malicious SVG that the /view endpoint serves inline in the application origin, executing arbitrary JavaScript in the browser of any user who opens it. Because image/svg+xml and related XML content types were missing from the dangerous-content-type list, uploaded markup rendered instead of downloading; a victim viewing the file triggers script that runs with full access to the ComfyUI session. No public exploit was identified at time of analysis and it is not listed in CISA KEV, but the fix commit and released version 0.28.0 are confirmed by the vendor advisory.