COMFYUI-EASY-USE · CVE-2026-123790 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
ComfyUI-Easy-Use 1.3.6 has a path traversal flaw in the save_preview() handler at POST /easyuse/save/{name}, which lets a request pick the custom_nodes directory as a copy destination. An unauthenticated attacker who can reach the ComfyUI server can overwrite an installed custom node's Python entry point, and the attacker's code runs with ComfyUI's privileges after a restart.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running ComfyUI with the ComfyUI-Easy-Use custom node (1.3.6 confirmed) where the ComfyUI server is reachable by untrusted users, since the endpoint needs no login. An attacker can upload a Python file to the input directory, copy it over an installed custom node's init.py with save_preview(), and get code execution at the next ComfyUI restart. Instances bound to localhost only, or behind network access controls, or without this extension can skip it.
Not affected if auth-required, extension-not-installed, localhost-only, no-easy-use-node, server-not-reachable
Who cares comfyui, comfyui-easy-use, no-fix, python, self-hosted
1.3.6 is the confirmed vulnerable one; other versions are untested, not known safe)127.0.0.1)ComfyUI-Easy-Use version 1.3.6 contains a path traversal vulnerability in the save_preview() handler for POST /easyuse/save/{name}. The handler checks the source directory before appending a user-supplied filename and allows the request to select the custom_nodes directory as a copy destination. An unauthenticated attacker who can reach the ComfyUI server can overwrite an installed custom node’s Python entry point with an uploaded file. When ComfyUI restarts and loads the modified node, the attacker’s code runs with the privileges of the ComfyUI process.
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
1.3.6 is confirmed vulnerable (by the reporter)