ComfyUI versions 0.1 through 0.13.0 contain a CSRF vulnerability in the create_origin_only_middleware function within server.py. This flaw allows remote attackers to trick authenticated users into submitting unauthorized requests, potentially leading to unintended actions within the application. The vulnerability does not require privileges or user interaction beyond the CSRF trigger. The vendor has not responded to disclosure, and no official remediation or patch has been provided. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on integrity.

Successful exploitation of this vulnerability could allow remote attackers to perform unauthorized actions on behalf of authenticated users via CSRF. The impact is limited to the scope of the affected functions and the privileges of the targeted user. There is no indication of direct confidentiality or availability impact. The vulnerability requires user interaction and does not require attacker privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing CSRF protections such as validating origin headers, using anti-CSRF tokens, or restricting access to trusted networks until an official patch is released.