Cross-Site Scripting Vulnerability in ComfyUI's SVG Handling

CVE-2026-56670

What is CVE-2026-56670?

The ComfyUI application, a modular GUI for diffusion models, had a severe vulnerability in handling SVG files prior to version 0.28.0. The /view endpoint was susceptible to stored cross-site scripting due to the absence of proper handling for the image/svg+xml content type. This flaw allowed an attacker to store malicious SVG content, which could be executed in the context of other users, compromising data integrity and user experience. The issue has been addressed in version 0.28.0, which safeguards against such exploitation.

References