A flaw in the View Endpoint server.py of ComfyUI allows an attacker to inject arbitrary JavaScript by manipulating the server request, resulting in cross‑site scripting when the resource is accessed. This vulnerability can be exploited remotely and the corresponding exploit has been made publicly available, indicating that attackers can trigger it from a distance without local access or privileged credentials.

All installations of ComfyUI up to and including version 0.13.0 are affected. The issue resides within the server.py component of the View Endpoint and exists in releases prior to 0.13.0 as well as the 0.13.0 release itself.

The CVSS score of 5.1 reflects a moderate risk level. The EPSS score is not published, and the vulnerability is not listed in CISA KEV. The attack vector is remote, meaning an attacker can initiate the exploitation from outside the system, and the fact that the exploit has been released to the public suggests that the likelihood of real‑world attacks may increase over time.