{
 "id": "AIR-2025-0402",
 "slug": "cve-2024-10481-comfyui-cross-site-request-forgery-vulnerabil",
 "title": "CVE-2024-10481: ComfyUI Cross-Site Request Forgery vulnerability",
 "summary": "A CSRF vulnerability exists in ComfyUI versions up to v0.2.2 allowing attackers to perform arbitrary API requests. This permits unauthorized file uploads and other actions when authenticated users visit malicious sites.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "ComfyUI"
 ],
 "incident_date": "2025-03-20",
 "incident_date_precision": "day",
 "first_reported": "2025-03-20",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10481",
   "publisher": "NVD",
   "title": "CVE-2024-10481: A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2.",
   "published_at": "2025-03-20"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2024-10481",
  "csrf"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}