On November 12, US CERT/CC announced a vulnerability (CVE-2026-123790) in versions 1.4.1 and earlier of "ComfyUI-Easy-Use," an extension for the generative AI tool "ComfyUI."
ComfyUI-Easy-Use is a popular extension that adds components called "nodes" to assemble image generation processes, making it easier to create complex workflows.
If an attacker can access the vulnerable function over a network without authentication, they can rewrite the extension's files. When ComfyUI restarts, the rewritten files are loaded, and the attacker's code could be executed.
Since the code runs with the same privileges as ComfyUI, files such as models and workflows accessible by ComfyUI could be read or modified.
CERT/CC advises users to either delete the extension or restrict ComfyUI access to trusted users only. The extension's developer has released a fix on their GitHub development branch.
