CVE-2026-108962: Code Injection in storyicon comfyui_segment_anything

This vulnerability exists in the SLConfig._file2dict function of the GroundingDINO Model Loading component within storyicon comfyui_segment_anything. Manipulation of the config argument can lead to code injection, allowing remote attackers to execute arbitrary code. Due to the project's rolling release model, no explicit version boundaries for affected or fixed releases are provided. The issue was reported early to the project but remains unaddressed as of the publication date.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code on affected systems by injecting malicious code through the config argument. This could compromise system integrity and confidentiality. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a fix is available, avoid exposing the vulnerable component to untrusted inputs or networks where possible.