comfyanonymous comfyui Incomplete Fix CVE-2024-10099 image cross site scripting

5.3 CVSS

Vulnerability Description

A vulnerability was found in comfyanonymous comfyui up to 0.3.39. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /upload/image of the component Incomplete Fix CVE-2024-10099. The manipulation of the argument image leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-6092

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Gavin Zhong (VulDB User)

References

More from comfyanonymous

View All →

CVE-2025-6107

comfyanonymous comfyui utils.py set_attr dynamically-determined object attributes

Low 2.3

CVE-2024-12882

SSRF in comfyanonymous/comfyui

High 7.5

CVE-2024-10481

Cross-Site Request Forgery (CSRF) in comfyanonymous/comfyui

Medium 6.5

CVE-2024-10099

Stored XSS in comfyanonymous/comfyui

Medium 6.1

Affected Vendor

comfyanonymous

View all reports →

Affected Software

comfyui

Vulnerable Versions:

0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.3.6, 0.3.7, 0.3.8, 0.3.9, 0.3.10, 0.3.11, 0.3.12, 0.3.13, 0.3.14, 0.3.15, 0.3.16, 0.3.17, 0.3.18, 0.3.19, 0.3.20, 0.3.21, 0.3.22, 0.3.23, 0.3.24, 0.3.25, 0.3.26, 0.3.27, 0.3.28, 0.3.29, 0.3.30, 0.3.31, 0.3.32, 0.3.33, 0.3.34, 0.3.35, 0.3.36, 0.3.37, 0.3.38, 0.3.39