TI-2024-11938 CVE-2024-12882 · GHSA-56p4-cfqw-jx4h
SSRF in comfyanonymous/comfyui
Priority HIGH 72
comfyanonymous/comfyui version v0.2.4 suffers from a non-blind Server-Side Request Forgery (SSRF) vulnerability.
comfyanonymous
Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
comfyanonymous records in CISA KEVNo comfyanonymous vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
7 records
TI-2024-09709 CVE-2024-10481 · GHSA-h9jx-rcv4-cgqg
Cross-Site Request Forgery (CSRF) in comfyanonymous/comfyui
Priority MEDIUM 62
A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2.
TI-2024-09361 CVE-2024-10099 · GHSA-5269-hjm8-7x5f
Stored XSS in comfyanonymous/comfyui
Priority MEDIUM 60
A stored cross-site scripting (XSS) vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier.
TI-2025-05502 CVE-2025-6092 · GHSA-495g-pwwr-x2vf
comfyanonymous comfyui Incomplete Fix CVE-2024-10099 image cross site scripting
Priority MEDIUM 57
A vulnerability was found in comfyanonymous comfyui up to 0.3.39.
TI-2025-05517 CVE-2025-6107 · GHSA-cq2m-wxm4-pqr4
comfyanonymous comfyui utils.py set_attr dynamically-determined object attributes
Priority MEDIUM 45
A vulnerability was found in comfyanonymous comfyui 0.3.40.
TI-2025-41188 CVE-2025-67303 · GHSA-95pq-hr8p-f5g7
An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially…
Priority MEDIUM 42
An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data.
TI-2026-18295 CVE-2026-22777 · GHSA-562r-8445-54r2
ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler
Priority MEDIUM 40
ComfyUI-Manager is an extension designed to enhance the usability of ComfyUI.