A cross-site scripting vulnerability in ComfyUI versions prior to 0.28.0 permits remote attackers to execute arbitrary scripts, posing a risk of session hijacking and unauthorized data access.

This is a cross-site scripting (XSS) vulnerability (CWE-79) resulting from improper neutralization of input during web page generation. The vulnerability is remotely exploitable and does not require authentication, although it requires user interaction.

The CVSS score of 8.2 reflects the high risk associated with XSS in an application that manages complex graph and node interfaces. Successful exploitation could lead to the theft of sensitive session tokens, unauthorized execution of API commands, or the compromise of user-driven diffusion model workflows.

Immediate Action: Update ComfyUI to version 0.28.0 or later to apply the necessary input sanitization fixes.

Proactive Monitoring: Review web access logs for suspicious input patterns or encoded scripts that might be directed at the ComfyUI interface.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS payloads directed at the ComfyUI backend and API endpoints.

Public Exploit Available: No (exploit_available: false)

All users of ComfyUI must upgrade to version 0.28.0 immediately to remediate this XSS vulnerability. Failure to patch leaves user sessions vulnerable to malicious script injection and potential unauthorized command execution within the application interface.