# CVE-2026-56670: Comfy-Org ComfyUI stored XSS in /view endpoint via SVG upload

Source: https://junglewise.ai/threats/cve-2026-56670-comfy-org-comfyui-stored-xss-in-view-endpoint-via-svg-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-56670 · Severity: high · CVSS 8.2 · Published 2026-07-31

ComfyUI, a popular interface for AI diffusion models, is vulnerable to a security flaw that allows attackers to execute malicious scripts in a user's browser. By uploading a specially crafted SVG image file, an attacker can trick the system into running code that could steal sensitive API tokens, access private workflows, or modify settings. This occurs because the system fails to properly restrict how SVG files are displayed, treating them as safe images rather than potential script carriers.

Technologies: [Comfy-Org ComfyUI](https://junglewise.ai/threats/technologies/comfyui). Vendors: [Comfy-Org](https://junglewise.ai/threats/vendors/comfy-org).

## Quick answers

**Is CVE-2026-56670 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56670 being exploited in the wild.

**How severe is CVE-2026-56670?** High severity, with a CVSS score of 8.2, published 31 July 2026.

**Which products and versions are affected?** Comfy-Org ComfyUI < 0.28.0.

**Is there a fix for CVE-2026-56670?** A patch was published on 2026-07-02: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56670 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-56670?** Check whether you run Comfy-Org ComfyUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in ComfyUI's /view endpoint. The root cause is the omission of 'image/svg+xml' and related XML content types from the application's dangerous-content-type blocklist. An unauthenticated attacker can upload a malicious SVG file containing inline scripts (e.g., via the /upload/image endpoint). When a user views this file, the server renders it inline without a 'Content-Disposition: attachment' header, leading to script execution within the ComfyUI origin. This allows for the exfiltration of API tokens and browser-stored data. The issue is resolved in version 0.28.0 by forcing a download (application/octet-stream) for these content types.

## Affected products

- Comfy-Org ComfyUI < 0.28.0

## Timeline

- 2026-07-02: patched: Fix committed to repository
- 2026-07-15: advisory: GitHub Security Advisory published
- 2026-07-31: disclosed: CVE published to NVD

## References

- [https://github.com/Comfy-Org/ComfyUI/commit/96e0e3585b41e1417442eaa14ec57f7b4ffcb5e0](https://github.com/Comfy-Org/ComfyUI/commit/96e0e3585b41e1417442eaa14ec57f7b4ffcb5e0)
- [https://github.com/Comfy-Org/ComfyUI/releases/tag/v0.28.0](https://github.com/Comfy-Org/ComfyUI/releases/tag/v0.28.0)
- [https://github.com/Comfy-Org/ComfyUI/security/advisories/GHSA-rj8c-c4p8-3c5h](https://github.com/Comfy-Org/ComfyUI/security/advisories/GHSA-rj8c-c4p8-3c5h)

## Related threats

- [ComfyUI path traversal in dataset save nodes](https://junglewise.ai/threats/cve-2026-92816-comfyui-path-traversal-in-dataset-save-nodes)
- [Comfy-Org ComfyUI unsafe deserialization in LoadTrainingDataset node](https://junglewise.ai/threats/cve-2026-68771-comfy-org-comfyui-unsafe-deserialization-in-loadtrainingdataset)
- [ComfyUI path traversal in LoadImage and media nodes](https://junglewise.ai/threats/cve-2026-56673-comfyui-path-traversal-in-loadimage-and-media-nodes)
- [Comfy-Org ComfyUI stored XSS in userdata endpoint](https://junglewise.ai/threats/cve-2026-56672-comfy-org-comfyui-stored-xss-in-userdata-endpoint)
- [Comfy-Org ComfyUI path traversal in model preview endpoint](https://junglewise.ai/threats/cve-2026-56671-comfy-org-comfyui-path-traversal-in-model-preview-endpoint)