CVE-2026-123790

A reachable ComfyUI preview extension could overwrite executable node files

ComfyUI-Easy-Use maintainers · ComfyUI-Easy-Use preview extension

First documented disclosure · Review checkpoint

Summary

Preview file handling failed to confine writes to the intended destination. Code could execute with the ComfyUI process’s privileges.

Severity and exploitation evidence

Critical · 9.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The reporting researcher reproduced the issue. The reviewed sources identify no malicious use.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Preview file handling failed to confine writes to the intended destination.

Conditions required

An unauthenticated client could reach the extension. The affected node loaded after restart.

Potential impact

Code could execute with the ComfyUI process’s privileges.

Affected versions and configurations

The CNA lists 1.3.6 through 1.4.1. CERT/CC confirmed the issue through 1.4.1.

Fix and mitigation status

CERT/CC identifies main-branch fix 8a0f2fc412. Its November 12 note does not name a numbered fixed release.

Practical next steps

Apply the verified upstream fix or remove the extension. Restrict network access to trusted users.

Operating lesson

Check the authority granted to the affected component against the operation a user expects.

Evidence and limits

The September 29 commit also addressed a separately reported September 27 browser issue that required user interaction. CERT/CC and the researcher disclosed the unauthenticated network issue on November 12. The 9.8 score is the reporter’s assessment. CERT/CC did not assign a score.

Sources