CVE-2026-56672

Name of the Vulnerable Software and Affected Versions ComfyUI versions prior to 0.28.0

Description Stored cross-site scripting (XSS) occurs because the application serves user-controlled HTML and SVG files with content types derived from their extensions. An attacker can use the 'POST /userdata' endpoint to store arbitrary request bodies within the user's userdata directory. When a victim accesses these files via the 'GET /userdata/{file}' endpoint, the embedded scripts execute within the same origin. This allows unauthorized access to browser-stored API tokens, settings, workflows, and the ability to make authenticated-equivalent API calls. The issue stems from the use of web.FileResponse(path), which serves .html and .svg files as 'text/html' and 'image/svg+xml' respectively, lacking the MIME type protections implemented in the '/view' endpoint.

Recommendations Update to version 0.28.0.