CVE-2024-10099: Comfy ComfyUI Stored XSS Vulnerability

CVE-2024-10099 Overview

CVE-2024-10099 is a stored cross-site scripting ([CWE-79]) vulnerability in comfyanonymous/comfyui version 0.2.2 and possibly earlier releases. ComfyUI is a node-based graphical interface for Stable Diffusion workflows. An attacker uploads an HTML file containing a malicious JavaScript payload through the /api/upload/image endpoint. The server accepts the file without validating that it matches an expected image type. When another user requests the file through the /view API endpoint, the browser renders the HTML and executes the embedded script in the origin of the ComfyUI application.

Critical Impact
An authenticated victim who views an attacker-supplied file executes arbitrary JavaScript in the ComfyUI origin, enabling session theft, workflow tampering, and interaction with the ComfyUI API on the victim's behalf.

Affected Products

comfyanonymous/comfyui version 0.2.2
Earlier ComfyUI releases that expose the /api/upload/image and /view endpoints without MIME enforcement
Deployments exposing the ComfyUI web interface to untrusted users

Discovery Timeline

2024-10-17 - CVE-2024-10099 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-10099

Vulnerability Analysis

ComfyUI's /api/upload/image endpoint stores files under a directory served by the application. The endpoint does not restrict uploads to image MIME types or enforce a safe Content-Type on retrieval. An attacker uploads a file with an HTML payload, and the server persists it as-is.

When a victim requests the file through /view, the server returns it with a rendering-friendly response. The browser interprets the HTML and executes any embedded <script> blocks or event-handler attributes in the ComfyUI origin. Because the script runs same-origin, it can read authentication cookies, call ComfyUI APIs, and modify user workflows. Exploitation requires user interaction, so the attacker must convince the victim to open the malicious /view URL.

Root Cause

The root cause is missing output sanitization and missing content-type enforcement on user-uploaded files. The upload handler trusts client-supplied file contents and extensions, and the retrieval handler serves the stored bytes with a MIME type the browser treats as renderable HTML instead of an inert application/octet-stream or a safe Content-Disposition: attachment response.

Attack Vector

The attack is network-reachable and requires low complexity. An attacker with the ability to reach /api/upload/image posts a multipart form request containing an HTML document. The server returns a filename or path that the attacker then shares with a victim as a /view URL. When the victim loads the link in an authenticated session, the payload runs. The vulnerability changes security scope because script execution in the ComfyUI origin can affect resources the victim controls, including saved workflows and API tokens.

No verified proof-of-concept code has been published. See the Huntr bounty report for the original disclosure and technical detail.

Detection Methods for CVE-2024-10099

Indicators of Compromise

Upload requests to /api/upload/image where the file body contains <script>, <iframe>, or on*= event-handler strings
Files stored in the ComfyUI input or output directory with .html, .htm, or .svg extensions
/view responses returning Content-Type: text/html for files delivered from the image directory
Outbound requests from victim browsers to attacker-controlled hosts shortly after loading a /view URL

Detection Strategies

Inspect web server access logs for POST requests to /api/upload/image followed by GET requests to /view for the same filename from a different source IP
Scan the ComfyUI upload directory for files whose contents fail image-format validation (missing PNG, JPEG, or WebP magic bytes)
Alert on HTTP responses from the ComfyUI service where Content-Type is text/html for a resource stored under the image path

Monitoring Recommendations

Enable request logging on the ComfyUI reverse proxy and forward logs to a centralized analytics platform for correlation
Monitor authenticated ComfyUI sessions for unexpected API calls issued immediately after a /view request
Track file uploads by MIME type and file extension to baseline normal usage and flag anomalies

How to Mitigate CVE-2024-10099

Immediate Actions Required

Restrict network access to ComfyUI so only trusted users can reach the /api/upload/image and /view endpoints
Place ComfyUI behind an authenticating reverse proxy that enforces per-user identity
Audit the upload directory for files with HTML, SVG, or script content and remove any that are not legitimate images
Review authenticated user sessions for signs of unauthorized workflow modification

Patch Information

No vendor-published fixed version is referenced in the NVD entry for CVE-2024-10099. Consult the Huntr bounty report and the upstream comfyanonymous/comfyui repository for the current release and any commits that address image upload validation. Upgrade to the latest available version and verify that uploads are restricted to image MIME types.

Workarounds

Configure the reverse proxy to force Content-Disposition: attachment and Content-Type: application/octet-stream on responses from the /view endpoint
Reject uploads at the proxy where the request body does not begin with a valid image magic-byte signature
Apply a strict Content Security Policy that disables inline script execution for the ComfyUI origin
Isolate ComfyUI on a dedicated hostname so that stolen cookies cannot access other applications

bash

# Example nginx configuration to force safe delivery of /view responses
location /view {
    proxy_pass http://comfyui_backend;
    proxy_hide_header Content-Type;
    add_header Content-Type "application/octet-stream" always;
    add_header Content-Disposition "attachment" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Content-Security-Policy "default-src 'none'; sandbox" always;
}