gcdRadar
products/comfyui-custom-nodes

ComfyUI + custom nodes

Filed as: ComfyUI, ComfyUI-Manager, comfyui_segment_anything, ComfyUI-Ace-Nodes, ComfyUI-Bmad-Nodes, ComfyUI-Copilot, ComfyUI-Easy-Use, ComfyUI-Impact-Pack

Records
24
Disclosed CVEs
24
Exploited (sev 3–4)
0
CISA KEV flagged
0

Newest record 2026-11-12 · 24 distinct CVE ids · open in the explorer (the explorer matches the first product a record names, so it can list fewer)

Exploited or KEV-listed · 0

Records at severity 3–4 (exploitation confirmed by CISA, the vendor or reporting) and records flagged as listed in CISA KEV. The KEV flag is the classifier’s cisa-kev tag or a source on the KEV catalog; it is recorded when the collector sees the listing, so a missing flag does not mean a CVE is absent from the catalog.

No record for ComfyUI + custom nodes has confirmed exploitation or a KEV flag.

Disclosures by month · last 24 months

Dec ’2423 disclosed · peak 5 in Apr ’26Nov ’26

Disclosed CVEs, no confirmed exploitation · 24

  1. closed
    ComfyUI + custom nodes CVE-2026-123790: ComfyUI‑Easy‑Use path traversal allows code execution

    Disclosed · since 12 Nov 2026 · CVE-2026-123790

    AI
  2. closed6.3
    ComfyUI + custom nodes CVE-2026-108962: Code injection in comfyui_segment_anything

    Disclosed · since 13 Oct 2026 · CVE-2026-108962

    AI
  3. closed8.5
    ComfyUI + custom nodes CVE-2026-92816: ComfyUI path traversal leads to code execution

    Disclosed · since 16 Sep 2026 · CVE-2026-92816

    AI
  4. closed8.2
    ComfyUI + custom nodes CVE-2026-56670: Stored XSS via SVG handling in ComfyUI view endpoint

    Disclosed · since 31 Jul 2026 · CVE-2026-56670

    AI
  5. closed8.2
    ComfyUI + custom nodes CVE-2026-56672: Stored XSS vulnerability in ComfyUI userdata endpoint

    Disclosed · since 31 Jul 2026 · CVE-2026-56672

    AI
  6. closed7.5
    ComfyUI + custom nodes CVE-2026-56673: ComfyUI Path Traversal and File Exfiltration Flaw

    Disclosed · since 31 Jul 2026 · CVE-2026-56673

    AI
  7. closed9.8
    ComfyUI + custom nodes CVE-2026-68771: ComfyUI Unsafe Deserialization in Training Dataset Node

    Disclosed · since 31 Jul 2026 · CVE-2026-68771

    AI
  8. closed7.5
    ComfyUI + custom nodes CVE-2026-56671: ComfyUI Path Traversal Vulnerability in Model Preview

    Disclosed · since 31 Jul 2026 · CVE-2026-56671

    AI
  9. closed3.1
    ComfyUI + custom nodes CVE-2026-13493: Flaw found in AIDC-AI ComfyUI-Copilot workflow checkpoint restore handler

    Disclosed · since 28 Jun 2026 · CVE-2026-13493

    AI
  10. closed4.3
    ComfyUI + custom nodes CVE-2026-6590: Path traversal in ComfyUI model preview endpoint

    Disclosed · since 20 Apr 2026 · CVE-2026-6590

    AI
  11. closed4.3
    ComfyUI + custom nodes CVE-2026-6589: CSRF vulnerability in ComfyUI server

    Disclosed · since 20 Apr 2026 · CVE-2026-6589

    AI
  12. closed3.5
    ComfyUI + custom nodes CVE-2026-6593: Cross-site scripting vulnerability in ComfyUI view endpoint

    Disclosed · since 20 Apr 2026 · CVE-2026-6593

    AI
  13. closed4.3
    ComfyUI + custom nodes CVE-2026-6591: Path traversal vulnerability in ComfyUI LoadImage node

    Disclosed · since 20 Apr 2026 · CVE-2026-6591

    AI
  14. closed3.5
    ComfyUI + custom nodes CVE-2026-6592: Cross-site scripting vulnerability in ComfyUI userdata endpoint

    Disclosed · since 20 Apr 2026 · CVE-2026-6592

    AI
  15. closed7.5
    ComfyUI + custom nodes CVE-2026-22777: ComfyUI-Manager configuration injection vulnerability

    Disclosed · since 10 Jan 2026 · CVE-2026-22777

    AI
  16. closed7.5
    ComfyUI + custom nodes ComfyUI-Manager Configuration and Critical Data Exposure

    Disclosed · since 5 Jan 2026 · CVE-2025-67303

    AI
  17. closed8.8
    Visionatrix CVE-2025-49126: Visionatrix XSS Vulnerability

    Disclosed · since 23 Jun 2025 · CVE-2025-49126

    AI
  18. closed3.1
    ComfyUI + custom nodes CVE-2025-6107: Attribute manipulation vulnerability in ComfyUI

    Disclosed · since 16 Jun 2025 · CVE-2025-6107

    AI
  19. closed4.3
    ComfyUI + custom nodes CVE-2025-6092: Cross-site scripting vulnerability in ComfyUI

    Disclosed · since 15 Jun 2025 · CVE-2025-6092

    AI
  20. closed6.5
    ComfyUI + custom nodes CVE-2024-10481: ComfyUI Cross-Site Request Forgery vulnerability

    Disclosed · since 20 Mar 2025 · CVE-2024-10481

    AI
  21. closed10.0
    ComfyUI + custom nodes CVE-2024-21577: Code injection vulnerability in ComfyUI-Ace-Nodes

    Disclosed · since 13 Dec 2024 · CVE-2024-21577

    AI
  22. closed10.0
    ComfyUI + custom nodes CVE-2024-21576: Code injection vulnerability in ComfyUI-Bmad-Nodes

    Disclosed · since 13 Dec 2024 · CVE-2024-21576

    AI
  23. closed9.2
    ComfyUI + custom nodes CVE-2024-21575: Path traversal vulnerability in ComfyUI-Impact-Pack

    Disclosed · since 12 Dec 2024 · CVE-2024-21575

    AI
  24. closed4.4
    LoLLMs CVE-2024-6673: CSRF vulnerability in LoLLMS WebUI ComfyUI installation endpoint

    Disclosed · since 29 Oct 2024 · CVE-2024-6673

    AI

Fix status and fixed versions are recorded when a source states them (each record’s page shows what is known); check the vendor’s own advisory before acting.