CVE-2026-56670: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Comfy-Org ComfyUI
CVE-2026-56670 is a high-severity cross-site scripting (XSS) vulnerability in Comfy-Org's ComfyUI prior to version 0.28.0. The issue arises because the /view endpoint served uploaded SVG files inline without properly handling dangerous content types like image/svg+xml, allowing stored XSS attacks. This vulnerability has been fixed in ComfyUI version 0.28.0.
AI Analysis
Technical Summary
ComfyUI versions before 0.28.0 improperly neutralize input during web page generation by serving uploaded SVG files inline at the /view endpoint without treating image/svg+xml and related XML content types as dangerous. This flaw allows an attacker to inject stored cross-site scripting payloads into the ComfyUI origin. The vulnerability is tracked as CWE-79 and has a CVSS 3.1 base score of 8.2, indicating high severity. The issue is resolved in version 0.28.0.
Potential Impact
Successful exploitation allows an attacker to execute stored cross-site scripting attacks within the ComfyUI web interface, potentially leading to partial confidentiality compromise (high impact on confidentiality), limited integrity impact, and no impact on availability. This could enable attackers to run arbitrary scripts in the context of the affected user's browser session.
Mitigation Recommendations
Upgrade ComfyUI to version 0.28.0 or later, where the vulnerability has been fixed by properly handling SVG and related XML content types to prevent inline serving that leads to stored XSS. No other mitigation guidance is provided or required.
CVE-2026-56670: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Comfy-Org ComfyUI
Description
CVE-2026-56670 is a high-severity cross-site scripting (XSS) vulnerability in Comfy-Org's ComfyUI prior to version 0.28.0. The issue arises because the /view endpoint served uploaded SVG files inline without properly handling dangerous content types like image/svg+xml, allowing stored XSS attacks. This vulnerability has been fixed in ComfyUI version 0.28.0.
CVSS v3.1
Score 8.2high
Affected software
Comfy-Org
ComfyUI
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
ComfyUI versions before 0.28.0 improperly neutralize input during web page generation by serving uploaded SVG files inline at the /view endpoint without treating image/svg+xml and related XML content types as dangerous. This flaw allows an attacker to inject stored cross-site scripting payloads into the ComfyUI origin. The vulnerability is tracked as CWE-79 and has a CVSS 3.1 base score of 8.2, indicating high severity. The issue is resolved in version 0.28.0.
Potential Impact
Successful exploitation allows an attacker to execute stored cross-site scripting attacks within the ComfyUI web interface, potentially leading to partial confidentiality compromise (high impact on confidentiality), limited integrity impact, and no impact on availability. This could enable attackers to run arbitrary scripts in the context of the affected user's browser session.
Mitigation Recommendations
Upgrade ComfyUI to version 0.28.0 or later, where the vulnerability has been fixed by properly handling SVG and related XML content types to prevent inline serving that leads to stored XSS. No other mitigation guidance is provided or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-22T16:39:01.043Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a6c31249c2644c7f8578d56
Added to database: 07/31/2026, 05:22:44 UTC
Last enriched: 08/07/2026, 14:40:38 UTC
Last updated: 09/12/2026, 22:01:35 UTC
Views: 47
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.