CVE-2026-6592
Received Received - Intake
Cross-Site Scripting in ComfyUI userdata Endpoint (Remote

Publication date: 2026-04-20

Last updated on: 2026-04-29

Assigner: VulDB

Description
A vulnerability has been found in ComfyUI up to 0.13.0. Affected by this vulnerability is the function getuserdata of the file app/user_manager.py of the component userdata Endpoint. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-20
Last Modified
2026-04-29
Generated
2026-06-16
AI Q&A
2026-04-20
EPSS Evaluated
2026-06-14
NVD
CVE-2026-6592
EUVD
EUVD-2026-23737
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
comfyui comfyui to 0.13.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

The vulnerability allows attackers to execute stored cross-site scripting (XSS) attacks by uploading malicious files that execute JavaScript in the context of the ComfyUI origin.

This enables attackers to access and steal sensitive data stored in the victim’s localStorage, including workflows, settings, and session data, and perform arbitrary API calls on behalf of the victim.

Such unauthorized access and potential data exfiltration could lead to violations of data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and breaches.

Therefore, this vulnerability poses a risk to compliance with these common standards and regulations by potentially exposing sensitive user data and compromising application integrity.

Executive Summary

This vulnerability exists in ComfyUI up to version 0.13.0, specifically in the getuserdata function within the app/user_manager.py file of the userdata Endpoint component.

The issue allows an attacker to perform cross-site scripting (XSS) attacks by manipulating this function.

The attack can be executed remotely, meaning an attacker does not need local access to exploit it.

The vulnerability has been publicly disclosed and the vendor did not respond to the notification.

Impact Analysis

This vulnerability can lead to cross-site scripting attacks, which may allow attackers to execute malicious scripts in the context of the affected application.

Such attacks can result in the theft of user session tokens, defacement of the website, or redirection to malicious sites.

Since the attack can be performed remotely, it increases the risk of exploitation without requiring physical or internal network access.

Detection Guidance

This vulnerability can be detected by testing the /userdata/{file} endpoint for the ability to upload and serve files with unsafe MIME types that allow script execution, such as .html or .svg files containing JavaScript.

A practical approach is to upload a malicious HTML file containing JavaScript via a POST request and then access the uploaded file to verify if the script executes.

Example commands to detect the vulnerability include:

  • Upload a test HTML file with embedded JavaScript using curl: curl -X POST "http://127.0.0.1:8188/userdata/test_xss.html" -d '<html><body><script>alert(document.domain)</script></body></html>'
  • Access the uploaded file in a browser to check if the JavaScript executes.
  • Verify the Content-Type header returned by the server using curl: curl -D - "http://127.0.0.1:8188/userdata/test_xss.html"
Mitigation Strategies

Immediate mitigation steps include restricting or disabling the ability to upload files to the /userdata endpoint, especially files with extensions that can be interpreted as executable scripts such as .html and .svg.

Implement Content-Type sanitization on the /userdata endpoint similar to the /view endpoint by forcing dangerous MIME types to application/octet-stream to prevent script execution.

Until a patch is available, consider restricting access to the /userdata endpoint to trusted users only or disabling the endpoint if possible.

Monitor and audit uploaded files for suspicious content and remove any files that could be exploited.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6592. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart