A vulnerability in ComfyUI, present in versions up to 0.13.0, allows a remote attacker to inject arbitrary script code through the getuserdata function of the userdata endpoint. The flaw arises from insufficient input validation, falling under CWE‑79 and CWE‑94. Successful exploitation could enable reflected or stored XSS, enabling an attacker to steal session cookies, deface pages, or execute further malicious actions within the victim’s browser context.

Any installation of ComfyUI whose version is 0.13.0 or earlier is vulnerable. The affected component is the getuserdata function in the userdata endpoint (app/user_manager.py).

The CVSS score of 5.1 indicates a moderate risk. The EPSS score is not available, so the likelihood of widespread exploitation remains uncertain, though the vulnerability is publicly disclosed and has been observed in the wild. Since it is not listed in the CISA KEV catalog the package is not formally recognized as a known exploit, yet the remote attack vector via HTTP and the absence of a vendor fix raise concerns. The attack would typically involve sending a crafted payload to the userdata endpoint, triggering the browser to execute the embedded script, potentially leading to information theft or session hijack.