Executive brief
ComfyUI, a popular interface for AI diffusion models, contains a critical security flaw that allows remote attackers to take full control of the server. By uploading a specially crafted file and triggering a specific data-loading process, an attacker can execute arbitrary commands on the underlying system. This could lead to the theft of sensitive AI models, data exposure, or the use of the server for further malicious activities.
Technical details
An unsafe deserialization vulnerability (CWE-502) exists in the LoadTrainingDataset node of ComfyUI due to the use of torch.load() without the weights_only=True restriction. An unauthenticated attacker can exploit this by first uploading a malicious pickle file (e.g., shard_*.pkl) via the /upload/image endpoint. Subsequently, the attacker can trigger the deserialization of this file by submitting a crafted workflow graph to the /prompt endpoint. The vulnerability leverages the Python __reduce__ method within the pickle payload to achieve arbitrary code execution as the user running the ComfyUI process. The issue is fixed in commit 94ee49b by enforcing weights_only=True during dataset loading.
Affected products
- Comfy-Org ComfyUI <= 0.23.0
Timeline
- 2026-06-18: patched: Fix merged into master branch via PR 14543
- 2026-07-31: disclosed: NVD publication date