A CVSS 9.8 unsafe deserialization flaw in ComfyUI's LoadTrainingDataset node lets unauthenticated remote attackers upload a malicious pickle file and execute arbitrary Python code on the host.
What Is It
CVE-2026-68771 is an unsafe deserialization vulnerability (CWE-502) in ComfyUI v0.23.0. The LoadTrainingDataset node passes attacker-supplied files to torch.load, which deserializes Python pickle data. A crafted pickle can define a __reduce__ method that executes arbitrary commands during deserialization.
The attack chain requires no credentials and no user interaction:
- Upload a malicious
shard_*.pklfile through the unauthenticatedPOST /upload/imageendpoint. - Queue a workflow graph via
POST /promptthat references the uploaded file. torch.loaddeserializes the payload and runs attacker commands as the ComfyUI process user.
The flaw was disclosed by VulnCheck and carries a CVSS 3.1 base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS 4.0 score of 9.3, both rated CRITICAL.
Why It Matters
The CVSS vector describes a network-reachable attack (AV:N) that requires no privileges (PR:N) and no user interaction (UI:N), with attack complexity rated LOW, no special conditions are needed for exploitation. Confidentiality, integrity, and availability impacts are all HIGH: successful exploitation gives the attacker code execution as the ComfyUI process user, with access to whatever that account can reach, including model files, workflow data, and any credentials available to it.
ComfyUI instances are frequently stood up on GPU boxes with generous local access and, in many deployments, exposed to a network without an authentication layer in front of them. According to VulnCheck's advisory, both endpoints used in the chain, POST /upload/image and POST /prompt, can be reached without authentication in a stock ComfyUI deployment, which is consistent with the PR:N rating in the published CVSS vector. Deployments that place a reverse proxy, SSO gateway, or other access control in front of the ComfyUI HTTP interface will not match that assumption.
What's Vulnerable
- Vendor: Comfy-Org
- Product: ComfyUI
- Affected versions: all versions up to and including 0.23.0 (semver,
<= 0.23.0)
The vulnerable component is the LoadTrainingDataset node, reachable via the /upload/image and /prompt HTTP endpoints.
Patch Status
A fix has been committed upstream. Commit 94ee49b1612824366a8631ea069b2a1fa5c73720 and pull request #14543 in the Comfy-Org/ComfyUI repository address the issue. Operators running 0.23.0 or earlier should update to a build containing that commit.
This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog, so there is no confirmed active exploitation or federal remediation deadline attached to it at this time. The NVD record status is "Received" (published 2026-07-31), meaning analysis is still pending.