An injection flaw in the configuration handler of the ComfyUI‑Manager extension allows an attacker who can manipulate HTTP query parameters to embed malformed or malicious characters. When the handler processes these parameters it writes the values directly to the config.ini file, enabling arbitrary configuration entries to be added or existing ones overridden. The result is tampering with security settings or altering application behavior, potentially compromising confidentiality, integrity, or availability of the system that relies on those configurations.

Vendors affected include Comfy‑Org’s ComfyUI‑Manager extension. Versions prior to 3.39.2 for the 3.x line and prior to 4.0.5 for the 4.x line are vulnerable.

The flaw is evaluated with a CVSS score of 7.5, indicating a high severity. Exploitation probability, measured by EPSS, is reported as less than 1%, suggesting that active attacks are rare but not impossible. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need network access to send crafted HTTP requests to the manager’s configuration endpoint, making the vector network-based. If successful, they could modify system behaviour or subvert security controls without needing privileged local access.