Comfyui
Monthly
Remote code execution in ComfyUI v0.23.0 (and all prior 0.x releases) lets unauthenticated attackers run arbitrary Python by abandoning the LoadTrainingDataset node to torch.load a malicious pickle. Because the upload and prompt-queue endpoints require no authentication, an attacker who can reach the web interface can upload a crafted shard_*.pkl file and trigger deserialization to execute commands as the ComfyUI process user. VulnCheck reported the flaw and a vendor fix exists; there is no public exploit identified at time of analysis, though the technique (pickle __reduce__ abuse) is trivial to reproduce.
Path traversal arbitrary file read in ComfyUI (comfy-org) before 0.28.0 lets remote unauthenticated attackers probe arbitrary host filesystem paths and exfiltrate image-format files via the /view endpoint. A crafted POST /prompt workflow using LoadImage or sibling loader nodes joins attacker-controlled annotated filenames to a base directory with no containment check, and LoadImage's VALIDATE_INPUTS method causes the engine to skip input-directory validation. Rated CVSS 7.5 (confidentiality-only); no public exploit identified at time of analysis and it is not on CISA KEV.
Stored cross-site scripting in ComfyUI (Comfy-Org) before 0.28.0 lets an attacker upload HTML or SVG to the per-user userdata store via POST /userdata and have it served with an executable content type by GET /userdata/{file}, so a script runs in the ComfyUI origin the moment a victim opens the file URL. Because it executes same-origin, the payload can read browser-stored API tokens, settings, and workflows and issue authenticated-equivalent API calls. Rated CVSS 8.2 (High); no public exploit identified at time of analysis and it is not in CISA KEV.
Unauthenticated information disclosure in ComfyUI (comfy-org/comfyui) before 0.28.0 lets remote attackers read arbitrary image-decodable files and enumerate the host filesystem via the get_model_preview endpoint, which joins an unrestricted {filename:.*} route capture to the model directory with no containment check (CWE-22). Attackers can use literal ../, percent-encoded %2e%2e%2f, absolute paths, or an unbounded path_index to escape the model folder; disclosure is bounded to files Pillow can decode plus a file-existence/path-enumeration oracle. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the issue is fixed in version 0.28.0.
Stored cross-site scripting in ComfyUI before 0.28.0 lets an attacker upload a malicious SVG that the /view endpoint serves inline in the application origin, executing arbitrary JavaScript in the browser of any user who opens it. Because image/svg+xml and related XML content types were missing from the dangerous-content-type list, uploaded markup rendered instead of downloading; a victim viewing the file triggers script that runs with full access to the ComfyUI session. No public exploit was identified at time of analysis and it is not listed in CISA KEV, but the fix commit and released version 0.28.0 are confirmed by the vendor advisory.
Cross-site scripting (XSS) in ComfyUI up to version 0.13.0 allows authenticated remote attackers to inject malicious scripts through the View Endpoint in server.py, affecting user integrity with publicly available exploit code. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting its severity despite network accessibility. ComfyUI's vendor has not responded to early disclosure attempts, and the exploit has been published on GitHub, making this a low-CVSS but publicly weaponized vulnerability affecting an AI image generation framework.
Stored cross-site scripting (XSS) in ComfyUI's userdata endpoint (getuserdata function in app/user_manager.py) allows authenticated attackers to inject malicious scripts that execute in other users' browsers. Affected versions range from 0.1 through 0.13.0. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting real-world impact, but publicly available exploit code exists and the vendor has not responded to disclosure.
Path traversal in ComfyUI up to version 0.13.0 allows authenticated remote attackers to read arbitrary files on the server by manipulating the Name argument in the LoadImage Node's folder_paths.get_annotated_filepath function. The vulnerability has publicly available exploit code and affects the image loading functionality, enabling attackers with valid credentials to access sensitive files outside intended directories.
Path traversal in ComfyUI up to version 0.13.0 allows authenticated remote attackers to read arbitrary files via manipulation of the get_model_preview function in the Model Preview Endpoint. An attacker with valid credentials can traverse the file system to access sensitive configuration files, model weights, or other data outside intended directories. Public exploit code is available, and the vendor has not provided a patched version despite early disclosure notification.
Cross-site request forgery (CSRF) in ComfyUI up to version 0.13.0 allows unauthenticated remote attackers to modify application state via crafted requests to the create_origin_only_middleware function in server.py. The vulnerability requires user interaction (clicking a malicious link or visiting an attacker-controlled site) but has low integrity impact and is publicly exploitable with proof-of-concept code available. The vendor has not responded to early disclosure notification.
comfyanonymous/comfyui version v0.2.4 suffers from a non-blind Server-Side Request Forgery (SSRF) vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A stored cross-site scripting (XSS) vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Remote code execution in ComfyUI v0.23.0 (and all prior 0.x releases) lets unauthenticated attackers run arbitrary Python by abandoning the LoadTrainingDataset node to torch.load a malicious pickle. Because the upload and prompt-queue endpoints require no authentication, an attacker who can reach the web interface can upload a crafted shard_*.pkl file and trigger deserialization to execute commands as the ComfyUI process user. VulnCheck reported the flaw and a vendor fix exists; there is no public exploit identified at time of analysis, though the technique (pickle __reduce__ abuse) is trivial to reproduce.
Path traversal arbitrary file read in ComfyUI (comfy-org) before 0.28.0 lets remote unauthenticated attackers probe arbitrary host filesystem paths and exfiltrate image-format files via the /view endpoint. A crafted POST /prompt workflow using LoadImage or sibling loader nodes joins attacker-controlled annotated filenames to a base directory with no containment check, and LoadImage's VALIDATE_INPUTS method causes the engine to skip input-directory validation. Rated CVSS 7.5 (confidentiality-only); no public exploit identified at time of analysis and it is not on CISA KEV.
Stored cross-site scripting in ComfyUI (Comfy-Org) before 0.28.0 lets an attacker upload HTML or SVG to the per-user userdata store via POST /userdata and have it served with an executable content type by GET /userdata/{file}, so a script runs in the ComfyUI origin the moment a victim opens the file URL. Because it executes same-origin, the payload can read browser-stored API tokens, settings, and workflows and issue authenticated-equivalent API calls. Rated CVSS 8.2 (High); no public exploit identified at time of analysis and it is not in CISA KEV.
Unauthenticated information disclosure in ComfyUI (comfy-org/comfyui) before 0.28.0 lets remote attackers read arbitrary image-decodable files and enumerate the host filesystem via the get_model_preview endpoint, which joins an unrestricted {filename:.*} route capture to the model directory with no containment check (CWE-22). Attackers can use literal ../, percent-encoded %2e%2e%2f, absolute paths, or an unbounded path_index to escape the model folder; disclosure is bounded to files Pillow can decode plus a file-existence/path-enumeration oracle. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the issue is fixed in version 0.28.0.
Stored cross-site scripting in ComfyUI before 0.28.0 lets an attacker upload a malicious SVG that the /view endpoint serves inline in the application origin, executing arbitrary JavaScript in the browser of any user who opens it. Because image/svg+xml and related XML content types were missing from the dangerous-content-type list, uploaded markup rendered instead of downloading; a victim viewing the file triggers script that runs with full access to the ComfyUI session. No public exploit was identified at time of analysis and it is not listed in CISA KEV, but the fix commit and released version 0.28.0 are confirmed by the vendor advisory.
Cross-site scripting (XSS) in ComfyUI up to version 0.13.0 allows authenticated remote attackers to inject malicious scripts through the View Endpoint in server.py, affecting user integrity with publicly available exploit code. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting its severity despite network accessibility. ComfyUI's vendor has not responded to early disclosure attempts, and the exploit has been published on GitHub, making this a low-CVSS but publicly weaponized vulnerability affecting an AI image generation framework.
Stored cross-site scripting (XSS) in ComfyUI's userdata endpoint (getuserdata function in app/user_manager.py) allows authenticated attackers to inject malicious scripts that execute in other users' browsers. Affected versions range from 0.1 through 0.13.0. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting real-world impact, but publicly available exploit code exists and the vendor has not responded to disclosure.
Path traversal in ComfyUI up to version 0.13.0 allows authenticated remote attackers to read arbitrary files on the server by manipulating the Name argument in the LoadImage Node's folder_paths.get_annotated_filepath function. The vulnerability has publicly available exploit code and affects the image loading functionality, enabling attackers with valid credentials to access sensitive files outside intended directories.
Path traversal in ComfyUI up to version 0.13.0 allows authenticated remote attackers to read arbitrary files via manipulation of the get_model_preview function in the Model Preview Endpoint. An attacker with valid credentials can traverse the file system to access sensitive configuration files, model weights, or other data outside intended directories. Public exploit code is available, and the vendor has not provided a patched version despite early disclosure notification.
Cross-site request forgery (CSRF) in ComfyUI up to version 0.13.0 allows unauthenticated remote attackers to modify application state via crafted requests to the create_origin_only_middleware function in server.py. The vulnerability requires user interaction (clicking a malicious link or visiting an attacker-controlled site) but has low integrity impact and is publicly exploitable with proof-of-concept code available. The vendor has not responded to early disclosure notification.
comfyanonymous/comfyui version v0.2.4 suffers from a non-blind Server-Side Request Forgery (SSRF) vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A stored cross-site scripting (XSS) vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.