What’s Vulnerable › Products

Comfy-Org ComfyUI vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your Comfy-Org ComfyUI version is affected

Latest Comfy-Org ComfyUI vulnerabilities

• CVE-2026-92816 — ComfyUI before 0.30.0 Path Traversal via dataset save nodes (CVSS 7.8)
• CVE-2026-68771 — ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization (CVSS 9.8)
• CVE-2026-56673 — ComfyUI: Path traversal in LoadImage via the /prompt API allows arbitrary file existence probing and image exfiltration (CVSS 7.5)
• CVE-2026-56672 — ComfyUI: Stored XSS via /userdata/{file} due to Missing Content-Type Sanitization (CVSS 8.2)
• CVE-2026-56671 — ComfyUI: Path traversal in /experiment/models/preview allows arbitrary image file read (CVSS 7.5)
• CVE-2026-56670 — ComfyUI: Stored XSS via SVG file upload on the /view endpoint (CVSS 8.2)