CVE-2026-108962
Received Received - Intake

Code Injection in ComfyUI Segment Anything

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulDB

Description
A vulnerability has been found in storyicon comfyui_segment_anything up to ab6395596399d5048639cdab7e44ec9fae857a93. Affected by this issue is the function SLConfig._file2dict of the file local_groundingdino/util/slconfig.py of the component GroundingDINO Model Loading. Such manipulation of the argument config leads to code injection. It is possible to launch the attack remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-108962
EUVD
EUVD-2026-98277

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
storyicon comfyui_segment_anything ab6395596399d5048639cdab7e44ec9fae857a93

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a code injection flaw in the comfyui_segment_anything project. It occurs in the SLConfig._file2dict function of local_groundingdino/util/slconfig.py when processing the config argument. An attacker can manipulate this to inject malicious code via a crafted config file, leading to remote code execution.

Detection Guidance

Check for suspicious .cfg.py files in the models directory of comfyui_segment_anything. Monitor for unexpected network connections or processes spawned by ComfyUI. Review logs for unrecognized model loading attempts or configuration file imports.

Impact Analysis

An attacker could execute arbitrary code on your system with the same privileges as the user running ComfyUI. This could lead to data theft, system compromise, or further network attacks. The attack requires user interaction, such as installing a malicious model package and running a workflow.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using this software may face compliance breaches, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Stop using comfyui_segment_anything until a patch is released. Avoid installing untrusted model packages. Restrict write permissions to the models directory. Monitor for unusual activity in ComfyUI processes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108962. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart