repository icon
comfyanonymous / comfyui Project repository

The most powerful and modular diffusion model GUI, api and backend with a graph/nodes interface.

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN34 DAYS

FIX

WITHINN/A DAYS

Deserializing unsafe data in comfyui leads to RCE
l1k3beef
duplicate
Critical
DNS Rebinding
sanktjodel
pending
SSRF via POST /internal/models/download and GET /view REST APIs
zpbrent
High
•$450•CVE-2024-12882
Cross-Site Request Forgery to XSS at workflow
srivallikusumba
duplicate
High
Cross-Site Request Forgery to XSS
srivallikusumba
duplicate
High
RCE via pickle deserialization (unpickling)
seqode
informative
High
Denial of service via CSRF
seqode
duplicate
Medium
Default CORS settings leads to sensitive data exfiltration
ethansilvas
informative
Medium
Unrestricted Upload of File with Dangerous Type
seqode
duplicate
Critical
CSRF allows for requests on behalf of authenticated users
ethansilvas
Medium
•CVE-2024-10481
XSS through viewing HTML files with /view
ethansilvas
Medium
•CVE-2024-10099
Race Condition Vulnerability: Concurrent File Overwrite Leading to Data Integrit...
morphykutay
informative
Medium
Delete any file on the system
hainguyen0207
self closed
Path Traversal in API `/userdata/{file}
duongli99
not applicable
closed
kienzx203
self closed