CVE-2026-68771
CRITICAL · 9.8Real vuln, clear attack path, early disclosure phase; no PoC/KEV yet, limited defender triage signal.
What: ComfyUI v0.23.0 unsafe deserialization in LoadTrainingDataset node allows unauthenticated remote code execution via malicious pickle files (CVSS 9.8 CRITICAL).
Why it matters: Attack chain is straightforward—upload pickle via unauthenticated /upload/image endpoint, trigger deserialization in workflow queue. No authentication required. Early social chatter shows defenders discussing mitigation (restrict endpoints); published one day ago with clear technical detail suggests initial researcher/vendor disclosure phase.
Where it's seen: Security news aggregators and infosec social media repeating the CVE announcement with mitigation guidance. No public PoC observed yet; no KEV listing. Tone is urgent but signals typical post-disclosure activity, not mass exploitation.
RISK: CRITICAL — Unauthenticated RCE with CVSS 9.8 affecting actively-used AI/ML tool; default-exposed endpoints.
Description
ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard_*.pkl file via the unauthenticated POST /upload/image endpoint and then queue a workflow graph via POST /prompt referencing the uploaded file, causing torch.load to deserialize the attacker-controlled pickle payload using __reduce__ and execute arbitrary commands as the ComfyUI process user.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High