Stored XSS in ComfyUI File Upload Handler

ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/{file} served user-controlled HTML and SVG files with extension-derived content types, allowing stored cross-site scripting in the ComfyUI origin and access to browser-stored API tokens, settings, workflows, and authenticated-equivalent API calls. The handler used web.FileResponse(path), so an uploaded .html/.svg was served as text/html/image/svg+xml. POST /userdata stores arbitrary request bodies (confined to the user's userdata directory). When a victim navigated to the file URL, the embedded script executed same-origin. The /view endpoint already forced dangerous MIME types to download; that protection had never been applied to /userdata. This issue is fixed in version 0.28.0.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

ComfyUI versions prior to 0.28.0 contain a stored cross-site scripting (XSS) vulnerability in the GET /userdata/{file} endpoint. The vulnerability arises from improper content-type handling when serving user-uploaded HTML and SVG files—the application derives the MIME type from file extensions and serves them directly as text/html or image/svg+xml without sanitization. This allows an attacker to upload malicious HTML or SVG files containing JavaScript payloads that execute in the ComfyUI origin, compromising sensitive data including browser-stored API tokens, user settings, workflows, and enabling authenticated API calls on behalf of the victim. Organizations and users relying on ComfyUI for AI model experimentation are at risk, particularly in multi-user or exposed deployment scenarios.

Casky's extended reasoning against the 322 mapped skills identifies this attack through detection of Credential Access (TA0001) and Exfiltration (TA0043) techniques. A practitioner would observe security findings highlighting suspicious file upload patterns where HTML/SVG content bypasses validation, combined with evidence of browser context execution and token extraction attempts. The skill set detects the critical chain: POST /userdata accepting arbitrary payloads (Initial Access) flowing to GET /userdata serving unvalidated markup (Execution), followed by indicators of API token enumeration from localStorage or sessionStorage (Credential Access). Casky's reasoning would surface the endpoint configuration gap, file type validation weakness, and the lack of Content Security Policy headers—enabling practitioners to prioritize remediation and threat hunt for similar patterns in their infrastructure before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-56672.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-56672

Casky has 322 skills that investigate the attack patterns behind CVE-2026-56672. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn