The issue resides in the SLConfig._file2dict function of the GroundingDINO model loading component. An attacker can manipulate the config argument sent to this function and inject code, leading to execution of arbitrary code. This code injection arises from the improper handling of input strings and code blocks, indicating weaknesses in string injection (CWE-74) and code injection (CWE-94).

The vulnerability affects the storyicon comfyui_segment_anything project. No specific version or patch set is listed, and the project uses rolling releases, so exact affected releases are unclear.

The CVSS baseline score is 5.3, indicating moderate severity. No EPSS data is available, and the issue is not in the CISA KEV catalog. The product’s rolling release model means the vulnerability could be present in multiple current builds. Because the attack vector relies on remote manipulation of a configuration file, an exploit would typically require remote code submission to the system or a compromised user with write access to configuration files. Overall, the risk is moderate with potential for remote code execution if the attacker can influence the config loading process.