| Title | A vulnerability was found in storyicon comfyui_segment_anything comfyui_segment_anything commit ab6395596399d5048639cdab7e44ec9fae857a93 (HEAD of main, no tagged releases) Code Injection |
|---|
| Description | A vulnerability was found in storyicon comfyui_segment_anything up to commit
ab6395596399d5048639cdab7e44ec9fae857a93 (main HEAD) and classified as
high 8.8. Affected is the GroundingDINO model loading component: the function
load_groundingdino_model in node.py resolves the model config sidecar
(*.cfg.py) in the user-writable models/grounding-dino/ directory via
get_local_filepath and passes it to SLConfig.fromfile. The manipulation of the
argument model config file leads to code injection. It is possible to launch
the attack remotely. User interaction is required: a crafted model package
must be installed into the models directory and a workflow selecting the
model must be queued.
Technical Details
- Affected file/function: local_groundingdino/util/slconfig.py SLConfig._file2dict()
(copies the .py config into a temporary directory, inserts it into sys.path
at line 88 and executes it via import_module at line 90); reached from
node.py get_local_filepath() / load_groundingdino_model(), which return any
same-named local config without origin or hash verification
- Vulnerable parameter: config sidecar file (*.cfg.py) of the GroundingDINO
model package in models/grounding-dino/
- Attack vector: Network (malicious package distributed via model-sharing channels)
- Privileges required: None (victim's own ComfyUI instance; no authentication
on the target)
- Trigger condition: execution happens at import_module time, before the .pth
checkpoint is read with torch.load, as soon as the user queues a workflow
selecting the model
Impact
- Confidentiality: High (arbitrary Python runs in-process with user privileges)
- Integrity: High (arbitrary code execution)
- Availability: High (arbitrary code execution)
CVSS v3.1
Score: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Timeline
- Discovered: 2026-09-25
- Vendor notified: [pending] (no private channel available; repository without
activity since 2024-03-21)
- Patch released: [pending]
- Public disclosure: [pending]
Countermeasure
Do not import Python config files from the models directory: treat model
configs as data (hardcode the known config dicts or use a safe non-executable
format), or verify the config SHA-256 against the upstream file before import
and fail closed on mismatch. |
|---|
| Source | ⚠️ https://github.com/storyicon/comfyui_segment_anything/issues/114 |
|---|
| User | Dem0 (UID 82596) |
|---|
| Submission | 09/24/2026 18:29 (17 days ago) |
|---|
| Moderation | 10/11/2026 21:33 (17 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416781 [storyicon comfyui_segment_anything up to ab6395596399d5048639cdab7e44ec9fae857a93 GroundingDINO Model Loading slconfig.py SLConfig._file2dict config code injection] |
|---|
| Points | 20 |
|---|