ComfyUI v0.23.0 contains an unsafe deserialization flaw in the LoadTrainingDataset node that permits unauthenticated attackers to execute arbitrary Python code. By uploading a malicious pickle file through the public POST /upload/image endpoint and then queuing a workflow with POST /prompt that references the file, the server deserializes the payload with torch.load. The exploit relies on Python’s __reduce__ method in the pickle, causing the server to run attacker‑supplied commands as the ComfyUI process user, providing full remote code execution.

The vulnerability is present in ComfyUI from the Comfy‑Org project, specifically version 0.23.0. No other versions or products are listed as affected in the current data.

The CVSS score of 9.3 marks this flaw as critical, while the EPSS score of less than 1% indicates a low probability of observed exploitation. The attack vector is unauthenticated HTTP requests; an adversary only needs network access to the endpoint to trigger the deserialization. Although the flaw is not yet catalogued as a known exploited vulnerability in CISA KEV, the impact of successful exploitation—arbitrary code execution on the host—demands aggressive countermeasures.