A stored cross‑site scripting flaw exists in ComfyUI’s /view endpoint. Because SVG files were served inline before version 0.28.0, an attacker who can upload a malicious SVG can embed JavaScript that executes in the context of the ComfyUI origin. This allows an attacker to manipulate the page, read user cookies, or perform actions that the victim’s browser would normally permit for that site.

The vulnerability impacts installations of Comfy‑Org ComfyUI that are running any version prior to 0.28.0. No specific sub‑versions are listed, so any release earlier than 0.28.0 is considered affected.

The CVSS score of 8.2 indicates a high severity of the flaw, while the EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by uploading a crafted SVG file to the /view endpoint, which requires write access to the upload location. The likely attack vector is through authenticated or compromised user accounts that have permission to upload or manipulate files. Once the page loads the stored SVG, the embedded script runs with the same privileges as the site, permitting a full range of client‑side attacks.