Comfy is a specialized AI image-generation framework and its ecosystem of extensions, with a narrow product scope centered on ComfyUI and related management tools. Its observed vulnerability surface reflects the web-facing nature of the platform, clustering around input-handling and request-validation weaknesses including cross-site scripting, cross-site request forgery, server-side request forgery, CRLF injection, and unprotected alternate channels. Current severity, exploitation status, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Comfy over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-67303HIGH An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the application storing it | Jan 5, 2026 | 7.5 | 39 | NO | YES |
CVE-2026-22777HIGH ComfyUI-Manager is an extension designed to enhance the usability of ComfyUI. Prior to versions 3.39.2 and 4.0.5, an attacker can inject special characters into HTTP query paramete | Jan 10, 2026 | 7.5 | 26 | NO | NO |
CVE-2024-12882HIGH comfyanonymous/comfyui version v0.2.4 suffers from a non-blind Server-Side Request Forgery (SSRF) vulnerability. This vulnerability can be exploited by combining the REST APIs `POS | Mar 20, 2025 | 7.5 | 21 | NO | NO |
CVE-2024-10099MEDIUM A stored cross-site scripting (XSS) vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier. The vulnerability occurs when an attacker uploads an HTML fil | Oct 17, 2024 | 6.1 | 19 | NO | NO |
CVE-2024-10481MEDIUM A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2. This vulnerability allows attackers to host malicious websites that, when visited by authenticated Comf | Mar 20, 2025 | 6.5 | 18 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Comfy.
Media articles that mention a CVE ID that affects a product developed by Comfy — matched by CVE ID, not by vendor name.