CVE-2026-56670: ComfyUI Stored XSS Vulnerability

CVE-2026-56670 Overview

CVE-2026-56670 is a stored cross-site scripting (XSS) vulnerability in ComfyUI, a modular diffusion model graphical user interface (GUI) with an API and graph/nodes backend. The /view endpoint served uploaded Scalable Vector Graphics (SVG) files inline because the image/svg+xml content type and related Extensible Markup Language (XML) dialects were absent from the dangerous-content-type handling logic. An authenticated user with upload access can plant a malicious SVG that executes JavaScript in the ComfyUI origin whenever another user views it. The issue affects versions prior to 0.28.0 and is tracked under [CWE-79].

Critical Impact
Stored XSS in the ComfyUI origin allows attackers to hijack user sessions, exfiltrate workflow data, and pivot to authenticated API actions against the ComfyUI backend.

Affected Products

ComfyUI versions prior to 0.28.0
Deployments exposing the /view endpoint for user-uploaded assets
Multi-user ComfyUI instances where SVG uploads are permitted

Discovery Timeline

2026-07-31 - CVE-2026-56670 published to the National Vulnerability Database (NVD)
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-56670

Vulnerability Analysis

ComfyUI exposes a /view route that returns uploaded assets to the browser. Prior to version 0.28.0, the handler enforced a static allowlist of dangerous Multipurpose Internet Mail Extensions (MIME) types comprising text/html, text/html-sandboxed, application/xhtml+xml, text/javascript, and text/css. That set omitted image/svg+xml, so SVG uploads were served with an inline Content-Disposition in the ComfyUI origin. SVG documents can embed <script> elements and event handlers, so the browser executes attacker-controlled JavaScript with same-origin access to cookies, tokens, and ComfyUI backend routes.

The same allowlist also missed charset suffixes, case variants, and +xml dialects, allowing bypasses even for known-dangerous types. Successful exploitation gives an attacker session-scoped control of the victim's ComfyUI tab, including the ability to submit workflows, read outputs, or call authenticated API endpoints on behalf of the victim.

Root Cause

The root cause is incomplete neutralization of input during web page generation. The /view handler in app/assets/api/routes.py performed content-type filtering against a hard-coded set that did not include image/svg+xml and did not normalize the MIME string, so user-uploaded XML-based assets rendered inline instead of being forced to download.

Attack Vector

An attacker uploads a crafted SVG containing embedded JavaScript to a ComfyUI instance. When a victim retrieves the asset through /view, the browser parses the file as SVG and executes the script in the ComfyUI origin. User interaction is required, but no privileges are needed once uploads are reachable.

python

            404, "FILE_NOT_FOUND", "Underlying file not found on disk."
        )

-    _DANGEROUS_MIME_TYPES = {
-        "text/html", "text/html-sandboxed", "application/xhtml+xml",
-        "text/javascript", "text/css",
-    }
-    if content_type in _DANGEROUS_MIME_TYPES:
+    # User-controlled asset content must never render inline in the app origin
+    # (stored XSS via SVG/HTML/XML). Force dangerous types to download and
+    # override any requested inline disposition. Centralised through
+    # folder_paths.is_dangerous_content_type so this can't drift from /view and
+    # /userdata (the previous inline set here omitted image/svg+xml and missed
+    # the charset/casing/+xml-dialect bypasses).
+    if folder_paths.is_dangerous_content_type(content_type):
         content_type = "application/octet-stream"
+        disposition = "attachment"

    safe_name = (filename or "").replace("\r", "").replace("\n", "")
    encoded = urllib.parse.quote(safe_name)

Source: GitHub Commit 96e0e35. The patch replaces the static set with folder_paths.is_dangerous_content_type() and forces Content-Disposition: attachment for any dangerous MIME type.

Detection Methods for CVE-2026-56670

Indicators of Compromise

SVG files present in ComfyUI upload directories containing <script>, onload=, or javascript: payloads.
HTTP responses from /view returning Content-Type: image/svg+xml with inline Content-Disposition on vulnerable versions.
Unexpected outbound requests from browser sessions with the ComfyUI origin as referrer.

Detection Strategies

Scan uploaded asset directories for SVG or XML files containing JavaScript event handlers or <script> tags.
Inspect web server access logs for /view requests returning MIME types such as image/svg+xml, application/xml, or any +xml dialect.
Correlate SVG upload events with subsequent authenticated ComfyUI API calls that deviate from normal workflow patterns.

Monitoring Recommendations

Alert on new file uploads to ComfyUI with SVG or XML extensions and inspect their contents.
Monitor for browser telemetry indicating script execution originating from the ComfyUI domain when serving asset content.
Track the deployed ComfyUI version across instances and flag any host still running a release prior to 0.28.0.

How to Mitigate CVE-2026-56670

Immediate Actions Required

Upgrade ComfyUI to version 0.28.0 or later, which centralizes dangerous content-type checks via folder_paths.is_dangerous_content_type.
Restrict access to ComfyUI instances behind authentication and network controls until the upgrade is applied.
Audit existing upload directories and remove any SVG or XML files containing embedded scripts.

Patch Information

The fix is available in ComfyUI v0.28.0. See the GitHub Security Advisory GHSA-rj8c-c4p8-3c5h and commit 96e0e35 for details. The patch forces dangerous MIME types to application/octet-stream and sets Content-Disposition: attachment on the /view endpoint.

Workarounds

Place ComfyUI behind a reverse proxy that rewrites responses containing Content-Type: image/svg+xml to application/octet-stream and sets Content-Disposition: attachment.
Block uploads of .svg, .xml, and .xhtml file extensions at the ingress layer until the upgrade completes.
Serve ComfyUI on a dedicated origin isolated from other authenticated web applications to limit the blast radius of any residual XSS.

bash

# Example nginx override forcing SVG downloads from the ComfyUI /view endpoint
location /view {
    proxy_pass http://comfyui_backend;
    proxy_hide_header Content-Disposition;
    if ($upstream_http_content_type ~* "image/svg\+xml|application/xml|\+xml") {
        add_header Content-Type "application/octet-stream" always;
        add_header Content-Disposition "attachment" always;
    }
}