Loading vulnerability…
CVE-2026-68771 is a critical unsafe deserialization vulnerability in ComfyUI v0.23.0 and earlier within the LoadTrainingDataset node. The vulnerable code path loads attacker-controlled training dataset shard files using PyTorch deserialization without enabling the safety control that restricts loading to tensor-compatible data. By supplying a crafted pickle payload and causing the application to deserialize it through torch.load(), an attacker can abuse Python pickle behavior, including reduce, to execute arbitrary Python code in the context of the ComfyUI process. The issue is reachable remotely because an unauthenticated attacker can first upload a malicious dataset shard and then submit a workflow graph that references the uploaded file, triggering deserialization and code execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone Python proof-of-concept exploit for CVE-2026-68771, targeting unauthenticated remote code execution in ComfyUI via insecure pickle deserialization in the LoadTrainingDataset node. The repository contains only two files: a README describing the vulnerability, affected versions, exploitation flow, and reconnaissance steps; and exploit.py, the actual exploit implementation. The exploit structure is straightforward. exploit.py defines a _Payload class whose pickle deserialization invokes os.system(cmd) through __reduce__. The upload_shard() function crafts a multipart/form-data POST request to /upload/image with type=output, subfolder=training_dataset, overwrite=true, and uploads the malicious pickle as shard_0000.pkl. The trigger() function submits a JSON workflow to /prompt containing a LoadTrainingDataset node wired to a SaveLatent node, forcing ComfyUI to load shard_0000.pkl with torch.load(). On vulnerable PyTorch versions (< 2.6), this executes the embedded command. Main exploit capabilities: unauthenticated arbitrary command execution on the remote server, either as a blind command (-c/--cmd) or as a reverse shell (--shell HOST:PORT). The reverse shell payload is hardcoded as a bash /dev/tcp one-liner wrapped with setsid for background execution. Output from executed commands is not returned by the application, so successful exploitation is intended to be observed via reverse shell callback or side effects such as file creation. The exploit is operational rather than framework-based: it uses only Python standard library modules (argparse, json, os, pickle, urllib) and directly interacts with the target over HTTP. It is not a scanner or detection-only script; it performs the full exploit chain end-to-end.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical unauthenticated remote code execution vulnerability in ComfyUI caused by unsafe pickle deserialization via torch.load in the LoadTrainingDataset node.
An unauthenticated remote code execution vulnerability in ComfyUI v0.23.0 caused by unsafe pickle deserialization in the LoadTrainingDataset node.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.