ComfyUI + custom nodes

Patch now: confirmed exploitation or KEV · 0

Records at severity 3–4 (exploitation confirmed by CISA, the vendor or reporting) and records flagged as listed in CISA KEV. The KEV flag is the classifier’s cisa-kev tag or a source on the KEV catalog; it is recorded when the collector sees the listing, so a missing flag does not mean a CVE is absent from the catalog.

No record for ComfyUI + custom nodes has confirmed exploitation or a KEV flag.

Disclosed CVEs, no confirmed exploitation · 23

1. 2026-10-13
   CVE-2026-108962

   CVE-2026-108962: Code injection in comfyui_segment_anything

   2 Disclosedcode-injection · comfyui

   record AIR-2026-0319NVD ↗
2. 2026-09-16
   CVE-2026-92816

   CVE-2026-92816: ComfyUI path traversal leads to code execution

   2 Disclosedcomfyui · path-traversal · rce

   record AIR-2026-0141NVD ↗
3. 2026-07-31
   CVE-2026-56670

   CVE-2026-56670: Stored XSS via SVG handling in ComfyUI view endpoint

   2 Disclosedxss · comfyui

   record AIR-2026-1237NVD ↗
4. 2026-07-31
   CVE-2026-56672

   CVE-2026-56672: Stored XSS vulnerability in ComfyUI userdata endpoint

   2 Disclosedxss · comfyui

   record AIR-2026-1235NVD ↗
5. 2026-07-31
   CVE-2026-56673

   CVE-2026-56673: ComfyUI Path Traversal and File Exfiltration Flaw

   2 Disclosedpath-traversal · data-leak

   record AIR-2026-1234NVD ↗
6. 2026-07-31
   CVE-2026-68771

   CVE-2026-68771: ComfyUI Unsafe Deserialization in Training Dataset Node

   2 Discloseddeserialization · rce

   record AIR-2026-1233NVD ↗
7. 2026-07-31
   CVE-2026-56671

   CVE-2026-56671: ComfyUI Path Traversal Vulnerability in Model Preview

   2 Disclosedpath-traversal

   record AIR-2026-1232NVD ↗
8. 2026-06-28
   CVE-2026-13493

   CVE-2026-13493: Flaw found in AIDC-AI ComfyUI-Copilot workflow checkpoint restore handler

   2 Disclosedinfra_vuln

   record AIR-2026-1131NVD ↗
9. 2026-04-20
   CVE-2026-6590

   CVE-2026-6590: Path traversal in ComfyUI model preview endpoint

   2 Disclosedpath_traversal · infra_vuln

   record AIR-2026-1042NVD ↗
10. 2026-04-20
    CVE-2026-6589

    CVE-2026-6589: CSRF vulnerability in ComfyUI server

    2 Disclosedcsrf · infra_vuln

    record AIR-2026-1041NVD ↗
11. 2026-04-20
    CVE-2026-6593

    CVE-2026-6593: Cross-site scripting vulnerability in ComfyUI view endpoint

    2 Disclosedxss

    record AIR-2026-1039NVD ↗
12. 2026-04-20
    CVE-2026-6591

    CVE-2026-6591: Path traversal vulnerability in ComfyUI LoadImage node

    2 Disclosedpath-traversal

    record AIR-2026-1038NVD ↗
13. 2026-04-20
    CVE-2026-6592

    CVE-2026-6592: Cross-site scripting vulnerability in ComfyUI userdata endpoint

    2 Disclosedxss

    record AIR-2026-1037NVD ↗
14. 2026-01-10
    CVE-2026-22777

    CVE-2026-22777: ComfyUI-Manager configuration injection vulnerability

    2 Disclosedinfra_vuln

    record AIR-2026-0937NVD ↗
15. 2026-01-05
    CVE-2025-67303

    ComfyUI-Manager Configuration and Critical Data Exposure

    2 Disclosedexposure

    record AIR-2026-0935NVD ↗
16. 2025-06-23
    CVE-2025-49126

    CVE-2025-49126: Visionatrix XSS Vulnerability

    2 Disclosedxss · fastapi

    record AIR-2025-0430NVD ↗
17. 2025-06-16
    CVE-2025-6107

    CVE-2025-6107: Attribute manipulation vulnerability in ComfyUI

    2 Disclosedcomfyui

    record AIR-2025-0427NVD ↗
18. 2025-06-15
    CVE-2025-6092

    CVE-2025-6092: Cross-site scripting vulnerability in ComfyUI

    2 Disclosedxss · comfyui

    record AIR-2025-0426NVD ↗
19. 2025-03-20
    CVE-2024-10481

    CVE-2024-10481: ComfyUI Cross-Site Request Forgery vulnerability

    2 Disclosedcsrf

    record AIR-2025-0402NVD ↗
20. 2024-12-13
    CVE-2024-21577

    CVE-2024-21577: Code injection vulnerability in ComfyUI-Ace-Nodes

    2 Disclosedcode-injection · rce

    record AIR-2024-0270NVD ↗
21. 2024-12-13
    CVE-2024-21576

    CVE-2024-21576: Code injection vulnerability in ComfyUI-Bmad-Nodes

    2 Disclosedcode-injection · rce

    record AIR-2024-0269NVD ↗
22. 2024-12-12
    CVE-2024-21575

    CVE-2024-21575: Path traversal vulnerability in ComfyUI-Impact-Pack

    2 Disclosedpath-traversal · rce

    record AIR-2024-0268NVD ↗
23. 2024-10-29
    CVE-2024-6673

    CVE-2024-6673: CSRF vulnerability in LoLLMS WebUI ComfyUI installation endpoint

    2 Disclosedcsrf · lollms

    record AIR-2024-0262NVD ↗