CVE-2026-68771
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node. An unauthenticated attacker can upload a crafted pickle file via the POST /upload/image endpoint and trigger its deserialization via POST /prompt, leading to arbitrary Python code execution through torch.load.
Risk Assessment
An attacker can remotely execute arbitrary code in the context of the ComfyUI process, potentially leading to full server compromise, data theft, or further attacks on the infrastructure.
Recommendation
Update ComfyUI to a version that fixes this vulnerability. If an update is not available, restrict access to the /upload/image and /prompt endpoints and avoid using untrusted pickle files.
Original NVD description (English source)
ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard_*.pkl file via the unauthenticated POST /upload/image endpoint and then queue a workflow graph via POST /prompt referencing the uploaded file, causing torch.load to deserialize the attacker-controlled pickle payload using __reduce__ and execute arbitrary commands as the ComfyUI process user.