Executive brief
ComfyUI, a popular interface for AI diffusion models, is vulnerable to a security flaw that allows attackers to execute malicious scripts in a user's browser. By uploading a specially crafted SVG image file, an attacker can trick the system into running code that could steal sensitive API tokens, access private workflows, or modify settings. This occurs because the system fails to properly restrict how SVG files are displayed, treating them as safe images rather than potential script carriers.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in ComfyUI's /view endpoint. The root cause is the omission of 'image/svg+xml' and related XML content types from the application's dangerous-content-type blocklist. An unauthenticated attacker can upload a malicious SVG file containing inline scripts (e.g., via the /upload/image endpoint). When a user views this file, the server renders it inline without a 'Content-Disposition: attachment' header, leading to script execution within the ComfyUI origin. This allows for the exfiltration of API tokens and browser-stored data. The issue is resolved in version 0.28.0 by forcing a download (application/octet-stream) for these content types.
Affected products
- Comfy-Org ComfyUI < 0.28.0
Timeline
- 2026-07-02: patched: Fix committed to repository
- 2026-07-15: advisory: GitHub Security Advisory published
- 2026-07-31: disclosed: CVE published to NVD