Skip to content
OpenAdvisories

Vendor

comfyanonymous

5 known vulnerabilities.

comfyanonymous at a glance

Last 12 months
0
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202520
May 202500
Apr 202500
Mar 202520
Feb 202500
Jan 202500
Dec 202400

Products

comfyanonymous/comfyui 3 comfyui 2
All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • Low 3.1
    CVE-2025-6107

    comfyanonymous comfyui utils.py set_attr dynamically-determined object attributes

    A vulnerability was found in comfyanonymous comfyui 0.3.40. It has been classified as problematic. Affected is the function set_attr of the file /comfy/utils.py. The manipulation leads to dynamically-determined object attributes. It is possible to launch the …

    comfyanonymous comfyui
  • Medium 4.3
    CVE-2025-6092

    comfyanonymous comfyui Incomplete Fix CVE-2024-10099 image cross site scripting

    A vulnerability was found in comfyanonymous comfyui up to 0.3.39. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /upload/image of the component Incomplete Fix CVE-2024-10099. The manipulation of the…

    comfyanonymous comfyui
  • High 7.5
    CVE-2024-12882

    SSRF in comfyanonymous/comfyui

    comfyanonymous/comfyui version v0.2.4 suffers from a non-blind Server-Side Request Forgery (SSRF) vulnerability. This vulnerability can be exploited by combining the REST APIs `POST /internal/models/download` and `GET /view`, allowing attackers to abuse the v…

    comfyanonymous comfyanonymous/comfyui
  • Medium 6.5
    CVE-2024-10481

    Cross-Site Request Forgery (CSRF) in comfyanonymous/comfyui

    A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2. This vulnerability allows attackers to host malicious websites that, when visited by authenticated ComfyUI users, can perform arbitrary API requests on behalf of the user. This can b…

    comfyanonymous comfyanonymous/comfyui
  • Medium 6.1
    CVE-2024-10099

    Stored XSS in comfyanonymous/comfyui

    A stored cross-site scripting (XSS) vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier. The vulnerability occurs when an attacker uploads an HTML file containing a malicious XSS payload via the `/api/upload/image` endpoint. The …

    comfyanonymous comfyanonymous/comfyui