CVE-2026-56672
Received Received - Intake

Stored XSS in ComfyUI via Userdata File Handling

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: GitHub, Inc.

Description
ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/{file} served user-controlled HTML and SVG files with extension-derived content types, allowing stored cross-site scripting in the ComfyUI origin and access to browser-stored API tokens, settings, workflows, and authenticated-equivalent API calls. The handler used web.FileResponse(path), so an uploaded .html/.svg was served as text/html/image/svg+xml. POST /userdata stores arbitrary request bodies (confined to the user's userdata directory). When a victim navigated to the file URL, the embedded script executed same-origin. The /view endpoint already forced dangerous MIME types to download; that protection had never been applied to /userdata. This issue is fixed in version 0.28.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-56672
EUVD
EUVD-2026-51402

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
comfyui comfyui 0.28.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in ComfyUI before version 0.28.0 allows stored cross-site scripting (XSS) attacks. The GET /userdata/{file} endpoint served user-uploaded HTML and SVG files with content types based on file extensions, enabling malicious scripts to execute in the ComfyUI origin. Attackers could upload malicious files via POST /userdata, which stores arbitrary data in the user's directory. When victims accessed these files, embedded scripts ran with the same origin, potentially stealing API tokens, settings, or workflows.

Detection Guidance

Check for uploaded HTML or SVG files in the userdata directory that may have been served with incorrect MIME types. Review server logs for requests to /userdata/{file} with .html or .svg extensions. Look for unexpected script execution in browser consoles when accessing these files.

Impact Analysis

This vulnerability could allow attackers to steal your API tokens, settings, or workflows by tricking you into accessing a malicious file. It could also enable unauthorized actions on your behalf, such as modifying your ComfyUI configuration or executing authenticated API calls.

Mitigation Strategies

Upgrade ComfyUI to version 0.28.0 or later. Remove any suspicious HTML or SVG files from the userdata directory. Implement strict file upload validation to block HTML/SVG uploads. Apply MIME type restrictions for /userdata/{file} to prevent misinterpretation of file types.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56672. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart