A Cross-site Scripting vulnerability in ComfyUI allows unauthenticated attackers to execute malicious scripts within a user session, posing a significant risk to data integrity and session security.

The application is susceptible to a Cross-site Scripting (CWE-79) vulnerability due to improper neutralization of input during web page generation. This flaw can be triggered by an unauthenticated attacker via a crafted web request.

The CVSS score of 8.2 reflects a high severity rating, primarily due to the potential for unauthorized script execution. Successful exploitation could lead to session hijacking, the theft of sensitive user data, or unauthorized actions performed on behalf of legitimate users, resulting in potential reputational damage and loss of administrative control.

Immediate Action: Update ComfyUI to version 0.28.0 or later to incorporate the necessary security patches.

Proactive Monitoring: Monitor web application logs for suspicious patterns, such as unusual URL parameters or payloads containing script tags.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall to filter malicious web traffic.

Public Exploit Available: No

Given the high CVSS score and the nature of XSS vulnerabilities, it is critical to prioritize the update to version 0.28.0. Failure to patch may expose users to persistent threats that compromise the integrity of the entire platform.