CyberRota Analysis
AI-GeneratedComfyUI v0.23.0 is vulnerable to an unsafe deserialization flaw in the LoadTrainingDataset node, allowing unauthenticated remote attackers to execute arbitrary Python code by uploading a specially crafted pickle file. This critical vulnerability enables attackers to exploit the system through the unauthenticated POST /upload/image endpoint, potentially compromising the integrity of the ComfyUI process. Organizations using this version should prioritize immediate remediation to mitigate the risk of unauthorized code execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard_*.pkl file via the unauthenticated POST /upload/image endpoint and then queue a workflow graph via POST /prompt referencing the uploaded file, causing torch.load to deserialize the attacker-controlled pickle payload using __reduce__ and execute arbitrary commands as the ComfyUI process user.