CVE-2024-10099mediumCWE-79

CVE-2024-10099: medium-severity vulnerability in comfyanonymous/comfyui

Stored XSS in comfyanonymous/comfyui

Published

Follow this CVE+ Monitor comfyanonymous/comfyui

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.4%
A stored cross-site scripting (XSS) vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier. The vulnerability occurs when an attacker uploads an HTML file containing a malicious XSS payload via the `/api/upload/image` endpoint. The payload is executed when the file is viewed through the `/view` API endpoint, leading to potential execution of arbitrary JavaScript code.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
comfyanonymous · comfyanonymous/comfyui
Related CVEs — comfyanonymous/comfyui

In the same product, most dangerous first.

CVE-2024-12882HIGHSSRF in comfyanonymous/comfyuiEPSS 0.8%CVE-2024-10481MEDIUMCross-Site Request Forgery (CSRF) in comfyanonymous/comfyuiEPSS 0.2%