MEDIUM🇬🇧 English

CVE-2024-10099

CVSS 6.1v3.1pub. 2024-10-17upd. 2024-10-21

A stored cross-site scripting (XSS) vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier. The vulnerability occurs when an attacker uploads an HTML file containing a malicious XSS payload via the `/api/upload/image` endpoint. The payload is executed when the file is viewed through the `/view` API endpoint, leading to potential execution of arbitrary JavaScript code.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

  • Comfy Comfyui

    APP
    Comfy
    0.2.2
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
XSS
CWE
Referencje

Powiązane podatności

CVE-2024-12882HIGH7.5ten sam produkt

comfyanonymous/comfyui version v0.2.4 suffers from a non-blind Server-Side Request Forgery (SSRF) vulnerabilit...

CVE-2024-10481MEDIUM6.5ten sam produkt

A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2. This vulnerability allows attacke...

CVE-2026-22777HIGH7.5ten sam vendor

ComfyUI-Manager is an extension designed to enhance the usability of ComfyUI. Prior to versions 3.39.2 and 4.0...

CVE-2025-67303HIGH7.5ten sam vendor

An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its confi...