This vulnerability in ComfyUI (up to version 0.13.0) involves a cross-site scripting issue in the View Endpoint of the file server.py component. An attacker can remotely manipulate input to execute script code in the context of a victim's browser. The CVSS 4.0 base score is 5.1, indicating medium severity, with attack vector network, low attack complexity, no privileges required, and user interaction needed. The vendor has not issued a patch or advisory, and the exploit code is publicly available.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of users interacting with the vulnerable endpoint, potentially leading to session hijacking, information disclosure, or other client-side impacts. The vulnerability requires user interaction and low privileges, limiting the scope somewhat. No direct impact on confidentiality, integrity, or availability of the server is indicated.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's channels for updates. Until a fix is released, consider restricting access to the vulnerable endpoint or implementing web application firewall (WAF) rules to detect and block XSS payloads targeting this component. Avoid interacting with untrusted inputs through the affected functionality.