CVE-2026-68771
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node. An unauthenticated attacker can upload a crafted pickle file via the POST /upload/image endpoint and trigger its deserialization via POST /prompt, leading to arbitrary Python code execution through torch.load.
Risk Assessment
An attacker can remotely execute arbitrary code in the context of the ComfyUI process, potentially leading to full server compromise, data theft, or further attacks on the infrastructure.
Recommendation
Update ComfyUI to a version that fixes this vulnerability. If an update is not available, restrict access to the /upload/image and /prompt endpoints and avoid using untrusted pickle files.
Other vulnerabilities in ComfyUI
See all- CVE-2026-56673High
ComfyUI prior to version 0.28.0 is vulnerable in folder_paths.get_annotated_filepath and exists_annotated_filepath. They join workflow-controlled filenames to a base directory without containment check, allowing an unauthenticated attacker to craft a POST /prompt request using LoadImage or similar nodes to probe arbitrary host paths and exfiltrate image-format files through /view.
- CVE-2026-56672High
ComfyUI prior to version 0.28.0 is vulnerable to stored cross-site scripting (XSS) in the GET /userdata/{file} endpoint. It serves user-controlled HTML and SVG files with extension-derived content types, allowing script execution in the ComfyUI origin and access to API tokens, settings, workflows, and authenticated-equivalent API calls.
- CVE-2026-56671High
ComfyUI prior to version 0.28.0 is vulnerable in the get_model_preview function in app/model_manager.py. It joins an unrestricted filename to a selected model directory without containment check, allowing an unauthenticated attacker to use traversal, absolute paths, or an unbounded path_index to read image-decodable files and enumerate host paths.
- CVE-2026-56670High
ComfyUI prior to version 0.28.0 is vulnerable to stored cross-site scripting (XSS) in the /view endpoint. It serves uploaded SVG files inline because image/svg+xml and related content types were not handled as dangerous, allowing script execution in the ComfyUI origin.
Original NVD description (English source)
ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard_*.pkl file via the unauthenticated POST /upload/image endpoint and then queue a workflow graph via POST /prompt referencing the uploaded file, causing torch.load to deserialize the attacker-controlled pickle payload using __reduce__ and execute arbitrary commands as the ComfyUI process user.