CVE-2026-56672: ComfyUI Stored XSS Vulnerability

CVE-2026-56672 Overview

CVE-2026-56672 is a stored cross-site scripting (XSS) vulnerability in ComfyUI, a node-based diffusion model GUI, API, and backend. Versions prior to 0.28.0 allow attackers to upload HTML or SVG files through the POST /userdata endpoint and have them served with executable content types via GET /userdata/{file}. When a victim navigates to the file URL, embedded scripts execute in the ComfyUI origin. This exposes browser-stored API tokens, settings, and workflows, and enables authenticated-equivalent API calls. The issue is tracked as [CWE-79] and fixed in ComfyUI 0.28.0.

Critical Impact
Stored XSS in the ComfyUI origin permits theft of API tokens, workflow data, and full API access equivalent to the victim user.

Affected Products

ComfyUI versions prior to 0.28.0
Comfy-Org ComfyUI backend and API server
ComfyUI deployments exposing the /userdata endpoint

Discovery Timeline

2026-07-31 - CVE-2026-56672 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-56672

Vulnerability Analysis

The vulnerability resides in ComfyUI's userdata handling routes. The POST /userdata endpoint stores arbitrary request bodies inside the authenticated user's userdata directory without content restrictions. The corresponding GET /userdata/{file} handler uses web.FileResponse(path), which sets the Content-Type header from the file extension. An uploaded .html file is served as text/html, and an .svg file is served as image/svg+xml. Both content types execute embedded JavaScript when rendered inline by the browser.

ComfyUI already enforced dangerous MIME type downgrades on its /view endpoint, forcing risky content types to download rather than render inline. That protection was never extended to /userdata, leaving the file-serving path exposed. The vulnerability falls under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Root Cause

The root cause is missing MIME type enforcement on the /userdata route. User-controlled content is served with extension-derived content types, and the previous inline blocklist omitted image/svg+xml and missed charset, casing, and +xml dialect bypasses.

Attack Vector

An attacker with the ability to reach POST /userdata uploads a crafted .html or .svg file containing JavaScript. The attacker then delivers the file URL to a victim. When the victim opens the link in an authenticated ComfyUI session, the payload executes same-origin and can read API tokens, exfiltrate workflows, or issue API calls as the victim.

python

            404, "FILE_NOT_FOUND", "Underlying file not found on disk."
        )

-    _DANGEROUS_MIME_TYPES = {
-        "text/html", "text/html-sandboxed", "application/xhtml+xml",
-        "text/javascript", "text/css",
-    }
-    if content_type in _DANGEROUS_MIME_TYPES:
+    # User-controlled asset content must never render inline in the app origin
+    # (stored XSS via SVG/HTML/XML). Force dangerous types to download and
+    # override any requested inline disposition. Centralised through
+    # folder_paths.is_dangerous_content_type so this can't drift from /view and
+    # /userdata (the previous inline set here omitted image/svg+xml and missed
+    # the charset/casing/+xml-dialect bypasses).
+    if folder_paths.is_dangerous_content_type(content_type):
         content_type = "application/octet-stream"
+        disposition = "attachment"

    safe_name = (filename or "").replace("\r", "").replace("\n", "")
    encoded = urllib.parse.quote(safe_name)

Source: GitHub Commit 96e0e35. The patch centralizes dangerous content-type detection through folder_paths.is_dangerous_content_type and forces an attachment disposition for user-controlled assets.

Detection Methods for CVE-2026-56672

Indicators of Compromise

HTTP POST requests to /userdata containing bodies with <script>, <svg>, or onload= payloads.
HTTP GET responses from /userdata/*.html or /userdata/*.svg with Content-Type: text/html or image/svg+xml.
Unexpected outbound requests from browser sessions carrying ComfyUI API tokens to attacker-controlled hosts.

Detection Strategies

Inspect web server or reverse proxy logs for .html, .svg, .xhtml, or .xml files served from /userdata paths.
Alert on file uploads to ComfyUI userdata directories whose contents match HTML or SVG signatures.
Correlate authenticated user navigation to /userdata/* URLs originating from external referrers.

Monitoring Recommendations

Log all POST /userdata request bodies and file extensions for post-incident review.
Monitor ComfyUI process file writes to the userdata directory for extensions capable of script execution.
Track anomalous API call sequences that follow a /userdata file view, indicating token abuse.

How to Mitigate CVE-2026-56672

Immediate Actions Required

Upgrade ComfyUI to version 0.28.0 or later, which applies the dangerous content-type enforcement to /userdata.
Rotate all ComfyUI API tokens and session credentials if the instance was exposed prior to patching.
Restrict network access to the ComfyUI server so only trusted users can reach the /userdata endpoint.

Patch Information

The fix is available in ComfyUI v0.28.0. The patch is documented in GitHub Security Advisory GHSA-53g8-45wq-pcv8 and implemented in commit 96e0e35. The change routes both /view and /userdata through folder_paths.is_dangerous_content_type and forces an attachment Content-Disposition.

Workarounds

Place ComfyUI behind a reverse proxy that rewrites Content-Type to application/octet-stream and sets Content-Disposition: attachment for /userdata/* responses.
Block uploads to /userdata for file extensions such as .html, .htm, .svg, .xhtml, .xml, .js, and .css.
Add a strict Content-Security-Policy header disallowing inline scripts to reduce impact if an attacker reaches the endpoint.

bash

# Example nginx snippet forcing safe delivery of ComfyUI userdata files
location ~ ^/userdata/ {
    proxy_pass http://comfyui_backend;
    proxy_hide_header Content-Type;
    add_header Content-Type application/octet-stream always;
    add_header Content-Disposition "attachment" always;
    add_header X-Content-Type-Options nosniff always;
}