CVE-2026-6593

Name of the Vulnerable Software and Affected Versions ComfyUI versions prior to 0.13.0

Description A flaw in the View Endpoint component within the server.py file allows for remote cross site scripting. Cross site scripting is a type of security gap where malicious scripts are injected into otherwise trusted websites.

Recommendations Update to a version later than 0.13.0. As a temporary workaround, restrict access to the View Endpoint component to minimize the risk of exploitation.