Read the docs
TI-2024-09709 Aliases CVE-2024-10481GHSA-h9jx-rcv4-cgqg

Cross-Site Request Forgery (CSRF) in comfyanonymous/comfyui

Priority MEDIUM 62CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2. This vulnerability allows attackers to host malicious websites that, when visited by authenticated ComfyUI users, can perform arbitrary API requests on behalf of the user. This can be exploited to perform actions such as uploading arbitrary files via the `/upload/image` endpoint. The lack of CSRF protections on API endpoints like `/upload/image`, `/prompt`, and `/history` leaves users vulnerable to unauthorized actions, which could be combined with other vulnerabilities such as stored-XSS to further compromise user sessions.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00225 13th percentileScored 2026-11-08
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
comfyanonymouscomfyanonymous/comfyuiup to latest—No fix listedCNA
  • comfyanonymous/comfyui Vendorcomfyanonymous Affected up to latest Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:comfy:comfyui:*:*:*:*:*:*:*:*up to 0.2.2Vulnerablecomfyanonymous
  • cpe:2.3:a:comfy:comfyui:*:*:*:*:*:*:*:* Versions up to 0.2.2 Vulnerable ·comfyanonymous

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-10481
  2. 2026-10-03 Alias added: GHSA-h9jx-rcv4-cgqg

References

Exploit 1

  • TI-2024-11938 SSRF in comfyanonymous/comfyui CVSS 3.0HIGH 7.5
  • TI-2024-09361 Stored XSS in comfyanonymous/comfyui CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences