Loading story…
ComfyUI disclosed and patched CVE-2026-56672, a high-severity stored cross-site scripting flaw affecting versions prior to 0.28.0. The bug allowed attacker-controlled HTML or SVG files uploaded through /userdata/{file} to be served back with extension-derived MIME types, causing script execution in the ComfyUI origin when a victim opened the file URL. A successful attack could expose browser-stored API tokens, settings, and workflows, and let an attacker perform authenticated-equivalent API actions. The issue was rated CVSS 8.2 and required user interaction for exploitation.
The fix shipped in ComfyUI 0.28.0 as part of security advisory GHSA-779p-m5rp-r4h4, which also addressed additional file-handling weaknesses. The patch centralized dangerous MIME-type detection and forced risky content on /userdata/{file}, /view, and /api/assets/{id}/content to download as application/octet-stream, while adding Content-Disposition: attachment and X-Content-Type-Options: nosniff headers. Developers also hardened /experiment/models/preview and related path-resolution logic against path traversal, symlink escape, invalid path indexes, empty filenames, and null-byte edge cases, with regression tests added for SVG, XML, HTML, JavaScript, and preview-file abuse scenarios.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A ComfyUI commit for security advisory GHSA-779p-m5rp-r4h4 added protections for dangerous MIME types on /userdata/{file} and other routes, forcing risky content to download and adding nosniff and attachment headers. The patch also addressed multiple path traversal and file-handling issues and included regression tests.
CVE-2026-56672 was disclosed as a high-severity stored XSS vulnerability in ComfyUI versions prior to 0.28.0. The flaw allowed attacker-controlled HTML or SVG served by /userdata/{file} to execute in the ComfyUI origin when a victim visited the file URL, and the issue was noted as fixed in version 0.28.0.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ComfyUI patched a stored cross-site scripting vulnerability tracked as **CVE-2026-56670** that allowed malicious SVG files uploaded to the platform to execute script in the application's origin when later rendered through the `/view` endpoint. The flaw affected versions prior to **`0.28.0`** because uploaded SVG content was served inline and `image/svg+xml` and related XML content types were not included in dangerous content-type handling, creating a path for attacker-controlled content to run in a victim's browser. The issue is classified as **`CWE-79`** and carries a **CVSS v3.1** vector of **`AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N`**, indicating high confidentiality impact with user interaction required. ComfyUI addressed the bug in **version `0.28.0`**, whose release notes also state that the update includes fixes for four vulnerabilities under **`GHSA-779p-m5rp-r4h4`**, alongside other security and stability improvements such as masking authorization headers in logs for Partner Nodes.
Jul 31, 2026
A critical remote code execution flaw tracked as **CVE-2026-68771** affects **ComfyUI v0.23.0** through unsafe deserialization in the `LoadTrainingDataset` node. An attacker can reportedly upload a crafted pickle file to the unauthenticated `POST /upload/image` endpoint and then trigger deserialization through `POST /prompt`, causing `torch.load` to process an attacker-controlled `shard_*.pkl` file. Because Python pickle deserialization can invoke arbitrary code via mechanisms such as `__reduce__`, successful exploitation can lead to command execution with the privileges of the ComfyUI process. A related ComfyUI code change shows the project hardened dataset shard loading by replacing `torch.load(f)` with `torch.load(f, weights_only=True)` in `comfy_extras/nodes_dataset.py`, limiting deserialization to weights-only data and reducing exposure to malicious serialized objects. Reported mitigations include upgrading to a version that incorporates the safer loading behavior, avoiding untrusted pickle files, and reviewing node security settings on exposed deployments.
Aug 1, 2026
Multiple high-severity vulnerabilities in **Open WebUI** allow attackers to plant malicious chat content that executes when viewed, leading to theft of JWTs and session tokens from `localStorage`, full account takeover, and compromise of sensitive AI assets. The flaws affect markdown rendering, citation and response iframe handling, and HTML file-serving paths, including cases where attacker-controlled content was rendered with dangerous HTML processing or iframe sandbox settings such as `allow-scripts allow-forms allow-same-origin`. Reported impacts include exposure of DOM data, `indexedDB`, cookies, backend API keys, model parameter files, private databases, and other enterprise AI resources. Several reports warn that if an administrator opens a malicious shared transcript or chat, the attack can escalate from stored XSS to **remote code execution** through Open WebUI's administrative features and Python-based functions or plugins, potentially yielding code execution on the Docker container or local host. The issues were addressed across releases including **v0.6.6** and **v0.7.0** by tightening file ownership checks, removing or making optional same-origin iframe access, and recommending stronger HTML sanitization and restrictive CSP settings; one report also provided a database query to hunt for stored chats containing suspicious `data:text/html` or `javascript:` embed payloads.
Jul 7, 2026