Stored Cross-Site Scripting Vulnerability in ComfyUI Product by ComfyOrg

CVE-2026-56672

What is CVE-2026-56672?

ComfyUI, a node-based diffusion model GUI and API, has a vulnerability where GET requests to /userdata/{file} can serve user-uploaded HTML and SVG files with dangerous content types. This flaw permits stored cross-site scripting, potentially exposing sensitive data such as API tokens and settings. Victims accessing the affected URLs may inadvertently execute malicious scripts within the same-origin context. This issue was remedied in version 0.28.0, which adds necessary safeguards against improper MIME type handling.

References