CVE-2026-68771 in ComfyUI
Summary
by MITRE • 08/01/2026
ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard_*.pkl file via the unauthenticated POST /upload/image endpoint and then queue a workflow graph via POST /prompt referencing the uploaded file, causing torch.load to deserialize the attacker-controlled pickle payload using __reduce__ and execute arbitrary commands as the ComfyUI process user.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability in ComfyUI v0.23.0 represents a critical unsafe deserialization flaw that fundamentally undermines the application's security posture by enabling remote code execution without authentication. This weakness exists within the LoadTrainingDataset node where the system fails to properly validate or sanitize input data during the deserialization process. The attack vector exploits the unauthenticated POST endpoint /upload/image which accepts file uploads without proper access controls, creating an entry point for malicious actors to introduce crafted pickle files into the system. The vulnerability is particularly dangerous because it leverages standard python serialization mechanisms that are commonly used for data persistence but become weaponized when improperly handled.
The technical exploitation occurs through a carefully constructed pickle file named shard_*.pkl that contains malicious payload designed to exploit the pickle deserialization mechanism. When the workflow graph is queued via the POST /prompt endpoint, the torch.load function attempts to deserialize the attacker-controlled pickle file, triggering the _reduce_ method which allows arbitrary code execution. This technique directly maps to CWE-502 which specifically addresses unsafe deserialization vulnerabilities where untrusted data is deserialized without proper validation or sanitization. The underlying issue demonstrates a classic path traversal and privilege escalation vulnerability where the application executes commands with the privileges of the ComfyUI process user, potentially leading to full system compromise.
The operational impact of this vulnerability extends far beyond simple code execution as it creates a persistent backdoor for attackers who can leverage the compromised system for further reconnaissance, lateral movement, and data exfiltration. Since the vulnerability operates without requiring authentication, any remote attacker with network access to the ComfyUI instance can exploit this flaw regardless of their credentials or access level. The attack chain demonstrates how seemingly benign file upload functionality can become a critical security risk when combined with unsafe deserialization practices, particularly in machine learning and AI development environments where pickle files are commonly used for model persistence. This vulnerability directly aligns with ATT&CK technique T1059.001 which covers command and scripting interpreter execution, allowing attackers to execute arbitrary code through the python pickle deserialization mechanism.
The exploitation process requires minimal prerequisites beyond basic network connectivity to the ComfyUI application, making it particularly attractive to threat actors who seek low-effort high-impact attacks. The attacker first uploads a malicious pickle file through the unauthenticated upload endpoint, then triggers the workflow execution which causes the system to deserialize the payload, ultimately executing commands as the ComfyUI process user. Security mitigations should focus on implementing strict input validation and sanitization for all deserialization operations, particularly in machine learning frameworks where pickle files are commonly used. Organizations should disable or restrict the use of pickle serialization for untrusted data, implement proper authentication controls for file upload endpoints, and apply principle of least privilege to limit the impact of successful exploitation. The vulnerability highlights the critical importance of secure coding practices around serialization mechanisms and demonstrates how modern AI development tools must incorporate security considerations into their core architecture to prevent such dangerous attack vectors from being exposed in production environments.