CVE-2026-6593

A Cross-Site Scripting (XSS) vulnerability (CVE-2026-6593) has been identified in ComfyUI versions up to 0.13.0, specifically within the View Endpoint functionality of the server.py file. The vulnerability allows attackers to manipulate the affected component to inject malicious scripts through the web interface. The vulnerability carries a CVSS score of 3.5 (LOW) with a network-based attack vector requiring low complexity and user interaction. The attack requires valid login credentials and user action to trigger, limiting the potential for widespread damage. The impact is restricted to integrity violations with no confidentiality or availability concerns. Exploitation status indicates active community attention with public exploit code available. However, the EPSS score of 0.00029 suggests minimal real-world exploitation likelihood relative to other vulnerabilities. The vendor was contacted early but did not respond to the disclosure, leaving this vulnerability unpatched in affected versions. Organizations running ComfyUI should consider updating to a version beyond 0.13.0 to mitigate this risk.