CVE-2026-22777
📋 TL;DR
ComfyUI-Manager extension versions before 3.39.2 and 4.0.5 contain an injection vulnerability where attackers can manipulate HTTP query parameters to inject arbitrary configuration values into config.ini. This allows tampering with security settings or altering application behavior. Users running vulnerable versions of ComfyUI-Manager are affected.
💻 Affected Systems
- ComfyUI-Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of ComfyUI security settings leading to unauthorized access, data exposure, or malicious code execution through configuration manipulation.
Likely Case
Unauthorized modification of application behavior, potential privilege escalation, or disruption of normal ComfyUI operations.
If Mitigated
Limited impact with proper input validation and access controls, potentially only affecting non-critical configuration values.
🎯 Exploit Status
Exploitation requires HTTP access to the vulnerable endpoint with specially crafted query parameters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.39.2 or 4.0.5
Vendor Advisory: https://github.com/Comfy-Org/ComfyUI-Manager/security/advisories/GHSA-562r-8445-54r2
Restart Required: Yes
Instructions:
1. Update ComfyUI-Manager extension to version 3.39.2 or 4.0.5. 2. Restart ComfyUI service. 3. Verify the update was successful.
🔧 Temporary Workarounds
Input Validation Filter
allImplement input validation to filter special characters in HTTP query parameters
# Requires custom middleware implementation
Access Restriction
allRestrict HTTP access to ComfyUI-Manager endpoints
# Configure firewall rules or web server access controls
🧯 If You Can't Patch
- Implement strict input validation for all HTTP query parameters
- Restrict network access to ComfyUI-Manager endpoints using firewall rules
🔍 How to Verify
Check if Vulnerable:
Check ComfyUI-Manager extension version in ComfyUI interface or extension directoryCheck Version:
# Check ComfyUI-Manager version in ComfyUI web interface under 'Manager' sectionVerify Fix Applied:
Verify ComfyUI-Manager version is 3.39.2 or 4.0.5 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests with special characters in query parameters
- Unexpected modifications to config.ini file
Network Indicators:
- HTTP requests containing special characters like ;, &, |, >, < in query parameters to ComfyUI-Manager endpoints
SIEM Query:
http.url:*comfyui* AND http.query:*[;|&|>|<]*