repository icon
comfyanonymous / comfyui Project repository

The most powerful and modular diffusion model GUI, api and backend with a graph/nodes interface.

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN22 DAYS

FIX

WITHINN/A DAYS

SSRF in ComfyUI-Manager install_model
wulonchia-pro
self closed
Test SSRF
wulonchia-pro
self closed
Unauthenticated /system_stats endpoint exposes runtime environment and process a...
massy-o
self closed
Arbitrary file read via path traversal in get_annotated_filepath
bersechub
self closed
Arbitrary file write via path traversal in dataset save nodes
amanverasia
duplicate
High
Arbitrary file write via path traversal in dataset nodes
buttergolemcode
duplicate
Critical
Unsafe Deserialization via torch.load() in ComfyUI Dataset Loading Leads to Remo...
elucidator-hky
self closed
CSRF Protection Bypass via Origin: null in Sandboxed Iframes Enables Remote Code...
aviral2642
pending
Unhandled Exception in get_dir_by_type() Causes Server Error on Upload Endpoint
xjin1020
pending
Sensitive Information Exposure via sys.argv in /system_stats Endpoint
xjin1020
duplicate
Medium
Path Traversal in /experiment/models/preview/ Allows Reading Arbitrary Image Fil...
xjin1020
pending
Unsafe torch.load() Without weights_only=True Enables Arbitrary Code Execution v...
mom3gool2030
pending
Unauthenticated arbitrary file read via path traversal in get_annotated_filepath
sn1r
duplicate
High
Unsafe deserialization via bare torch.load in ComfyUI model and checkpoint loadi...
etwithin
pending
RCE via Unsafe Pickle Deserialization in Dataset Nodes with Path Traversal
jeremysommerfeld8910-cpu
pending
CSRF Protection Bypass on Non-Loopback Bindings Leads to Remote Code Execution i...
brianmcwilliams
pending
Remote Code Execution via unsafe torch.load() in LoadTrainingDataset node
sebasfavaron
duplicate
Critical
Arbitrary Code Execution via Unsafe Pickle Deserialization in Checkpoint Loading
squadan
duplicate
High
Information Disclosure via sys.argv exposure in /system_stats endpoint leaks cre...
iiviel
duplicate
Medium
Path Traversal + Pickle Deserialization RCE via Dataset Nodes in comfy_extras/no...
iiviel
duplicate
Critical
Unsafe Deserialization + Path Traversal in LoadTrainingDataset Node Enables Unau...
jhacksman
duplicate
Critical
Command-Line Arguments Exposed via /system_stats Endpoint
mr-neutr0n
pending
Symlink-Based Arbitrary File Read via /view Endpoint
mr-neutr0n
pending
Regular Expression Denial of Service (ReDoS) in String Function Nodes
reaperoak
pending
Bypass of CVE-2024-10481: CSRF Protection Evaded via Null Origin (Sandboxed Ifra...
reaperoak
pending
Bypass of CVE-2024-10099: Stored XSS via SVG (Incomplete Mime Type Blocklist)
reaperoak
pending
Privilege Escalation via Configuration Injection in ComfyUI-Manager
d0n9
pending
SSRF via UNC Path injection leads to credential compromise
terminaljockey
pending
Path traversal leads to arbitrary file reads
faizann24
pending
Insecure Seed Generation Enables Prompt Reconstruction via Brute-Forcing a 32bit...
felixmaechtle
pending
Unauthenticated remote code execution vulnerability
boy-hack
pending
Deserializing unsafe data in comfyui leads to RCE
l1k3beef
duplicate
Critical
DNS Rebinding
sanktjodel
pending
SSRF via POST /internal/models/download and GET /view REST APIs
zpbrent
High
•$450•CVE-2024-12882
Cross-Site Request Forgery to XSS at workflow
srivallikusumba
duplicate
High
Cross-Site Request Forgery to XSS
srivallikusumba
duplicate
High
RCE via pickle deserialization (unpickling)
seqode
informative
High
Denial of service via CSRF
seqode
duplicate
Medium
Default CORS settings leads to sensitive data exfiltration
ethansilvas
informative
Medium
Unrestricted Upload of File with Dangerous Type
seqode
duplicate
Critical
CSRF allows for requests on behalf of authenticated users
ethansilvas
Medium
•CVE-2024-10481
XSS through viewing HTML files with /view
ethansilvas
Medium
•CVE-2024-10099
Race Condition Vulnerability: Concurrent File Overwrite Leading to Data Integrit...
morphykutay
informative
Medium
Delete any file on the system
hainguyen0207
self closed
Path Traversal in API `/userdata/{file}
duongli99
not applicable
closed
kienzx203
self closed