ComfyUI before 0.30.0 fails to sanitize folder_name input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through modified startup files or package initializers.
ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard_*.pkl file via the unauthenticated POST /upload/image endpoint and then queue a workflow graph via POST /prompt referencing the uploaded file, causing torch.load to deserialize the attacker-controlled pickle payload using __reduce__ and execute arbitrary commands as the ComfyUI process user.
CVE-2026-56670 is a high-severity cross-site scripting (XSS) vulnerability in Comfy-Org's ComfyUI prior to version 0.28.0. The issue arises because the /view endpoint served uploaded SVG files inline without properly handling dangerous content types like image/svg+xml, allowing stored XSS attacks. This vulnerability has been fixed in ComfyUI version 0.28.0.
CVE-2026-56673 is a path traversal vulnerability in Comfy-Org's ComfyUI prior to version 0.28.0. The issue arises because certain functions join user-controlled filenames to a base directory without verifying containment, allowing unauthenticated attackers to read arbitrary files. This affects multiple nodes including LoadImage and related nodes. The vulnerability is fixed in version 0.28.0.
ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/{file} served user-controlled HTML and SVG files with extension-derived content types, allowing stored cross-site scripting in the ComfyUI origin and access to browser-stored API tokens, settings, workflows, and authenticated-equivalent API calls. The handler used web.FileResponse(path), so an uploaded .html/.svg was served as text/html/image/svg+xml. POST /userdata stores arbitrary request bodies (confined to the user's userdata directory). When a victim navigated to the file URL, the embedded script executed same-origin. The /view endpoint already forced dangerous MIME types to download; that protection had never been applied to /userdata. This issue is fixed in version 0.28.0.
CVE-2026-56671 is a path traversal vulnerability in Comfy-Org's ComfyUI prior to version 0.28.0. The vulnerability exists in the get_model_preview function, which improperly joins an unrestricted filename route to a model directory without containment checks. This allows unauthenticated remote attackers to read image-decodable files outside the intended directory by using traversal sequences or absolute paths. The disclosed files are processed through Pillow and re-encoded as WEBP, limiting disclosure to image-compatible files and enabling file existence enumeration. The issue is fixed in version 0.28.0.
ComfyUI-Manager is an extension designed to enhance the usability of ComfyUI. Prior to versions 3.39.2 and 4.0.5, an attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the config.ini file. This can lead to security setting tampering or modification of application behavior. This issue has been patched in versions 3.39.2 and 4.0.5.