Vulnerabilities

TI-2026-18295 CVE-2026-22777 · GHSA-562r-8445-54r2

ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler

MEDIUM 40

ComfyUI-Manager is an extension designed to enhance the usability of ComfyUI.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00866 Published 2026-01-10 Fixed in 4.0.5, 3.39.2 CWE-93

TI-2025-41188 CVE-2025-67303 · GHSA-95pq-hr8p-f5g7

MEDIUM 42

An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01392 Published 2026-01-05 Fixed in 3.38 CWE-420

TI-2025-05517 CVE-2025-6107 · GHSA-cq2m-wxm4-pqr4

MEDIUM 45

A vulnerability was found in comfyanonymous comfyui 0.3.40.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00438 Published 2025-06-16 No fix listed CWE-913

TI-2025-05502 CVE-2025-6092 · GHSA-495g-pwwr-x2vf

MEDIUM 57

A vulnerability was found in comfyanonymous comfyui up to 0.3.39.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00379 Published 2025-06-15 No fix listed CWE-79

TI-2024-11938 CVE-2024-12882 · GHSA-56p4-cfqw-jx4h

HIGH 72

comfyanonymous/comfyui version v0.2.4 suffers from a non-blind Server-Side Request Forgery (SSRF) vulnerability.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00767 Published 2025-03-20 No fix listed CWE-918

TI-2024-09709 CVE-2024-10481 · GHSA-h9jx-rcv4-cgqg

MEDIUM 62

A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.00225 Published 2025-03-20 No fix listed CWE-352

TI-2024-09361 CVE-2024-10099 · GHSA-5269-hjm8-7x5f

MEDIUM 60

A stored cross-site scripting (XSS) vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00373 Published 2024-10-17 No fix listed CWE-79