{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-68771/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-68771"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ComfyUI (0.23.0)"],"_cs_severities":["critical"],"_cs_tags":["remote-code-execution","deserialization","cve-2026-68771"],"_cs_type":"advisory","_cs_vendors":["ComfyUI"],"content_html":"\u003cp\u003eComfyUI version 0.23.0 contains a critical vulnerability (CVE-2026-68771) within the LoadTrainingDataset node, stemming from the unsafe deserialization of pickle files. This flaw allows an unauthenticated remote attacker to execute arbitrary Python code on the host system. The attack vector involves uploading a crafted, malicious pickle file (typically named in the shard_*.pkl format) via the application's file upload interface. Once the file is hosted, the attacker triggers its deserialization by queuing a workflow graph that references the malicious file. Because the application utilizes the torch.load function to process these files, an attacker can leverage the pickle protocol's \u003cstrong\u003ereduce\u003c/strong\u003e method to execute arbitrary system commands under the security context of the ComfyUI process. This vulnerability poses a significant risk to any publicly accessible ComfyUI instance, as it requires no prior authentication to achieve full system compromise.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a publicly accessible ComfyUI instance running version 0.23.0.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious Python pickle file containing a \u003cstrong\u003ereduce\u003c/strong\u003e method designed to execute arbitrary OS commands.\u003c/li\u003e\n\u003cli\u003eAttacker sends an unauthenticated HTTP POST request to the /upload/image endpoint to store the malicious pickle file on the server.\u003c/li\u003e\n\u003cli\u003eAttacker constructs a JSON workflow graph referencing the path of the newly uploaded malicious file.\u003c/li\u003e\n\u003cli\u003eAttacker sends an unauthenticated HTTP POST request to the /prompt endpoint to submit the workflow graph for processing.\u003c/li\u003e\n\u003cli\u003eThe LoadTrainingDataset node within the ComfyUI backend processes the workflow and calls torch.load on the malicious file.\u003c/li\u003e\n\u003cli\u003eThe pickle deserialization occurs, triggering the execution of the attacker's payload.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves remote code execution, enabling further activity such as data exfiltration or persistence.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full remote code execution on the underlying server. This enables attackers to steal sensitive data, gain persistent access to the host, or leverage the compromised system to perform further attacks on the internal network. Given the typical deployment of ComfyUI in AI and research environments, this may lead to the exposure of proprietary model data or credentials.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eImmediately update ComfyUI to a patched version that sanitizes or restricts the loading of untrusted pickle files.\u003c/li\u003e\n\u003cli\u003eIf an immediate update is not possible, restrict network access to the ComfyUI web interface, ensuring it is not accessible from the public internet.\u003c/li\u003e\n\u003cli\u003eImplement network-level blocking for unauthorized POST requests directed at the /upload/image and /prompt endpoints.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious POST requests to /upload/image followed by calls to /prompt containing references to .pkl files.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rules provided in this brief to detect the exploitation of CVE-2026-68771.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-07-31T23:46:59Z","date_published":"2026-07-31T23:46:59Z","id":"https://feed.craftedsignal.io/briefs/2026-07-comfyui-deserialization/","summary":"ComfyUI version 0.23.0 is vulnerable to unauthenticated remote code execution via unsafe deserialization of malicious pickle files.","title":"Unauthenticated Remote Code Execution in ComfyUI via Unsafe Deserialization","url":"https://feed.craftedsignal.io/briefs/2026-07-comfyui-deserialization/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-68771","version":"https://jsonfeed.org/version/1.1"}