Loading vulnerability…
Unauthenticated RCE in ComfyUI LoadTrainingDataset
CVE-2026-68771 is a critical unsafe deserialization vulnerability in ComfyUI v0.23.0 and earlier within the LoadTrainingDataset node. The vulnerable code path loads attacker-controlled training dataset shard files using PyTorch deserialization without enabling the safety control that restricts loading to tensor-compatible data. By supplying a crafted pickle payload and causing the application to deserialize it through torch.load(), an attacker can abuse Python pickle behavior, including reduce, to execute arbitrary Python code in the context of the ComfyUI process. The issue is reachable remotely because an unauthenticated attacker can first upload a malicious dataset shard and then submit a workflow graph that references the uploaded file, triggering deserialization and code execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation results in unauthenticated remote code execution as the ComfyUI process user. This can lead to full compromise of the affected host or container depending on runtime privileges, including theft of credentials accessible to the process, exfiltration or tampering of models and workflows, deployment of additional malware such as cryptominers, service disruption, and lateral movement into connected environments. Confidentiality, integrity, and availability impact are all high.
If you can’t patch tonight, do this now.
If immediate patching is not possible, prevent untrusted access to ComfyUI by removing direct public exposure and placing the service behind authenticated reverse-proxy controls. Restrict or disable unauthenticated file upload and workflow queueing functionality, tightly limit which users can submit dataset files, and enforce allowlisting of accepted file types and trusted data sources. Run ComfyUI with least OS privileges and in an isolated environment to reduce blast radius. Review logs for suspicious upload activity or unexpected processing of serialized training shard files.
Patch, then assume compromise.
Upgrade ComfyUI to a patched release that hardens LoadTrainingDataset by using safe PyTorch loading behavior, specifically restricting deserialization to tensor-compatible data with the appropriate safety flag. Ensure all deployments run a version in which the vulnerable torch.load usage in the dataset-loading path has been corrected. After upgrading, review exposed workflow and upload functionality and validate that untrusted serialized dataset files are no longer accepted in a way that can trigger arbitrary object deserialization.
2 exploits validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.