Loading story…
A critical remote code execution flaw tracked as CVE-2026-68771 affects ComfyUI v0.23.0 through unsafe deserialization in the LoadTrainingDataset node. An attacker can reportedly upload a crafted pickle file to the unauthenticated POST /upload/image endpoint and then trigger deserialization through POST /prompt, causing torch.load to process an attacker-controlled shard_*.pkl file. Because Python pickle deserialization can invoke arbitrary code via mechanisms such as __reduce__, successful exploitation can lead to command execution with the privileges of the ComfyUI process.
A related ComfyUI code change shows the project hardened dataset shard loading by replacing torch.load(f) with torch.load(f, weights_only=True) in comfy_extras/nodes_dataset.py, limiting deserialization to weights-only data and reducing exposure to malicious serialized objects. Reported mitigations include upgrading to a version that incorporates the safer loading behavior, avoiding untrusted pickle files, and reviewing node security settings on exposed deployments.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A CVE entry disclosed CVE-2026-68771, a critical unauthenticated remote code execution flaw in ComfyUI v0.23.0 caused by unsafe deserialization in the LoadTrainingDataset node. The disclosure states attackers can upload a crafted pickle file via `POST /upload/image` and trigger code execution through `POST /prompt`.
A ComfyUI code commit changed `torch.load(f)` to `torch.load(f, weights_only=True)` in `comfy_extras/nodes_dataset.py`, reducing unsafe deserialization risk when loading training-dataset shard files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ComfyUI disclosed and patched **CVE-2026-56672**, a high-severity stored cross-site scripting flaw affecting versions prior to `0.28.0`. The bug allowed attacker-controlled HTML or SVG files uploaded through `/userdata/{file}` to be served back with extension-derived MIME types, causing script execution in the ComfyUI origin when a victim opened the file URL. A successful attack could expose browser-stored API tokens, settings, and workflows, and let an attacker perform authenticated-equivalent API actions. The issue was rated `CVSS 8.2` and required user interaction for exploitation. The fix shipped in ComfyUI `0.28.0` as part of security advisory **GHSA-779p-m5rp-r4h4**, which also addressed additional file-handling weaknesses. The patch centralized dangerous MIME-type detection and forced risky content on `/userdata/{file}`, `/view`, and `/api/assets/{id}/content` to download as `application/octet-stream`, while adding `Content-Disposition: attachment` and `X-Content-Type-Options: nosniff` headers. Developers also hardened `/experiment/models/preview` and related path-resolution logic against path traversal, symlink escape, invalid path indexes, empty filenames, and null-byte edge cases, with regression tests added for SVG, XML, HTML, JavaScript, and preview-file abuse scenarios.
Jul 31, 2026
ComfyUI patched a stored cross-site scripting vulnerability tracked as **CVE-2026-56670** that allowed malicious SVG files uploaded to the platform to execute script in the application's origin when later rendered through the `/view` endpoint. The flaw affected versions prior to **`0.28.0`** because uploaded SVG content was served inline and `image/svg+xml` and related XML content types were not included in dangerous content-type handling, creating a path for attacker-controlled content to run in a victim's browser. The issue is classified as **`CWE-79`** and carries a **CVSS v3.1** vector of **`AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N`**, indicating high confidentiality impact with user interaction required. ComfyUI addressed the bug in **version `0.28.0`**, whose release notes also state that the update includes fixes for four vulnerabilities under **`GHSA-779p-m5rp-r4h4`**, alongside other security and stability improvements such as masking authorization headers in logs for Partner Nodes.
Jul 31, 2026
A critical vulnerability, tracked as **CVE-2026-26215**, enables **unauthenticated remote code execution (RCE)** in *manga-image-translator* when run in **shared API mode**. The exposed FastAPI endpoints `POST /simple_execute/{method}` and `POST /execute/{method}` deserialize attacker-controlled request bodies using `pickle.loads()` without validation (**CWE-502**), allowing a remote attacker to execute arbitrary code in the server context by sending a crafted pickle payload. The intended protection—a nonce-based authorization check—can be bypassed because the nonce defaults to an empty string (falsy in Python), causing the check to be skipped in typical deployments. Public reporting ties the issue to *manga-image-translator* **beta-0.3 and earlier**, and documents the vulnerable code paths in `manga_translator/mode/share.py` as well as associated upstream issue discussions and an advisory reference.
Jun 29, 2026