CVE-2026-6592 - ComfyUI userdata Endpoint user_manager.py getuserdata cross site scripting

Back Back to CVE browser

MEDIUM

ComfyUI userdata Endpoint user_manager.py getuserdata cross site scripting

Published Apr 20, 2026

5.1

MEDIUM

CVSS 4.0

EPSS 0.40%

Description

A vulnerability has been found in ComfyUI up to 0.13.0. Affected by this vulnerability is the function getuserdata of the file app/user_manager.py of the component userdata Endpoint. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor n/a Product ComfyUI Default
n/a
- Version
  0.1
  Status
  affected
  Constraints
  -
- Version
  0.10
  Status
  affected
  Constraints
  -
- Version
  0.11
  Status
  affected
  Constraints
  -
- Version
  0.12
  Status
  affected
  Constraints
  -
- Version
  0.13.0
  Status
  affected
  Constraints
  -
- Version
  0.2
  Status
  affected
  Constraints
  -
- Version
  0.3
  Status
  affected
  Constraints
  -
- Version
  0.4
  Status
  affected
  Constraints
  -
- Version
  0.5
  Status
  affected
  Constraints
  -
- Version
  0.6
  Status
  affected
  Constraints
  -
- Version
  0.7
  Status
  affected
  Constraints
  -
- Version
  0.8
  Status
  affected
  Constraints
  -
- Version
  0.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

ComfyUI

n/a

Version	Status	Constraints
0.1	affected	-
0.10	affected	-
0.11	affected	-
0.12	affected	-
0.13.0	affected	-
0.2	affected	-
0.3	affected	-
0.4	affected	-
0.5	affected	-
0.6	affected	-
0.7	affected	-
0.8	affected	-
0.9	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-79

Cross-site Scripting (XSS)

CWE-94

Code Injection

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23737
Advisory
https://gist.github.com/YLChen-007/50f0cdc5e3f7b737ce99c783e487ca0d
exploit
https://vuldb.com/submit/791113
third-party-advisory
https://vuldb.com/vuln/358227
vdb-entrytechnical-description
https://vuldb.com/vuln/358227/cti
signaturepermissions-required

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23737		Advisory
https://gist.github.com/YLChen-007/50f0cdc5e3f7b737ce99c783e487ca0d		exploit
https://vuldb.com/submit/791113		third-party-advisory
https://vuldb.com/vuln/358227		vdb-entrytechnical-description
https://vuldb.com/vuln/358227/cti		signaturepermissions-required