Description
ComfyUI-Manager is an extension designed to enhance the usability of ComfyUI. Prior to versions 3.39.2 and 4.0.5, an attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the config.ini file. This can lead to security setting tampering or modification of application behavior. This issue has been patched in versions 3.39.2 and 4.0.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Comfy-Org | ComfyUI-Manager | >= 4.0.0, < 4.0.5, < 3.39.2 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
Si13NTTT/CVE-2026-22777 ★ 0 · Sep 28, 2026
CVE-2026-22777 ComfyUI-Manager CRLF Injection leading to RCE chained with CVE-2025-67303
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- ComfyUI-Manager < 3.39.2 - CRLF Configuration Injection http/cves/2026/CVE-2026-22777.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | comfy-cli | >= 4.0.0, < 4.0.5 | 4.0.5 | GHSA-562r-8445-54r2 |
| PyPI | comfy-cli | < 3.39.2 | 3.39.2 | GHSA-562r-8445-54r2 |
| PyPI | comfy-cli | < 3.39.2 · >= 4.0.0, < 4.0.5 | 3.39.2, 4.0.5 | PYSEC-2026-1260 |