Comfy-org Comfyui
5 CVEs affecting Comfy-org Comfyui. Latest disclosed: 2026-07-31. Critical: 1, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-68771 | Critical | 9.8 | 2026-07-31 | ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitr… |
CVE-2026-56672 | High | 8.2 | 2026-07-31 | ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/{file} served user-controlled HTML and SVG files with extension-d… |
CVE-2026-56670 | High | 8.2 | 2026-07-31 | ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, the /view endpoint served uploaded SVG files inline be… |
CVE-2026-56673 | High | 7.5 | 2026-07-31 | ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to 0.28.0, folder_paths.get_annotated_filepath and exists_ann… |
CVE-2026-56671 | High | 7.5 | 2026-07-31 | ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, get_model_preview in app/model_manager.py joins an unr… |