This vulnerability in ComfyUI (up to version 0.13.0) involves the getuserdata function of the userdata endpoint, where insufficient input sanitization leads to cross-site scripting (XSS). An attacker can remotely exploit this flaw to inject malicious scripts, potentially impacting users interacting with the affected component. The vulnerability has been publicly disclosed, but the vendor has not issued a fix or advisory. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on confidentiality and integrity.

Successful exploitation allows remote attackers to perform cross-site scripting attacks, which can lead to execution of arbitrary scripts in the context of the affected application. This may result in session hijacking, defacement, or other client-side impacts. The vulnerability is rated medium severity with a CVSS score of 5.1. There are no known exploits in the wild at this time.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a fix is released, consider restricting access to the affected endpoint or implementing web application firewall (WAF) rules to detect and block XSS payloads targeting the getuserdata function. Avoid exposing the vulnerable component to untrusted users where possible.