CVE-2026-22777: ComfyUI-Manager CRLF Injection Vulnerability
Summary
CVE-2026-22777: ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler. Affects comfy-cli across 2 version ranges.
< 3.39.2
>= 4.0.0, < 4.0.5
Fixed in 3.39.2 or 4.0.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ComfyUI-Manager is a tool designed for managing the ComfyUI framework, which is used for creating user interfaces in Python applications. It allows users to configure settings and manage the application through a configuration file named 'config.ini'. The application is particularly vulnerable when configured with the '--listen' option, enabling remote access, which exposes it to potential attacks.
Vulnerability Detail
The vulnerability arises from improper handling of HTTP query parameters in the configuration handler, specifically through the ConfigParser module. An attacker can exploit this by injecting CRLF (Carriage Return Line Feed) characters into the parameters, allowing them to manipulate the 'config.ini' file. This could lead to unauthorized changes in security settings or application behavior, potentially compromising the integrity of the application.
How To Fix
Latest published version: 1.23.0 as of 23 Oct 2026
pip install --upgrade "comfy-cli==1.23.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.39.23.39.2pip install --upgrade "comfy-cli==3.39.2" -
>= 4.0.0, < 4.0.54.0.5pip install --upgrade "comfy-cli==4.0.5"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not feasible, consider implementing the following workarounds: 1. Run ComfyUI-Manager only on trusted networks. 2. Block external access via a firewall. 3. Run the application on localhost only without using the '--listen' option.
Conclusion
The CRLF Injection vulnerability in ComfyUI-Manager poses a significant risk to users who enable remote access. It is crucial to update to the latest patched versions or implement workarounds to mitigate potential threats. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for comfy-cli →
FAQ
CRLF Injection is a type of attack where an attacker injects Carriage Return and Line Feed characters into a web application, potentially allowing them to manipulate HTTP headers or files.
Users running ComfyUI-Manager with the '--listen' option enabled are at risk, especially in environments where remote access is allowed.
Exploitation of this vulnerability can lead to unauthorized modifications of the configuration file, which may alter security settings or application behavior.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high level of severity.
