Critical RCE Flaw Found in ComfyUI v0.23.0

ComfyUI version 0.23.0 contains a critical unsafe deserialization vulnerability within the LoadTrainingDataset node. This flaw, tracked as CVE-2026-68771, allows unauthenticated remote attackers to execute arbitrary Python code by uploading a malicious pickle file and triggering its deserialization through the workflow graph.

What's at Risk

This vulnerability affects users running ComfyUI v0.23.0. Because the flaw is accessible via unauthenticated endpoints, any instance of the software exposed to the internet is at significant risk of compromise. Organizations or individuals hosting ComfyUI on public-facing servers are the primary targets, as attackers do not need prior access or credentials to initiate the exploit.

The vulnerability carries a CVSS 3.1 score of 9.8, indicating a critical severity level. Successful exploitation grants the attacker the ability to run commands with the same privileges as the user running the ComfyUI process, which could lead to full system takeover, data theft, or further lateral movement within a network.

How the Flaw Works

Unsafe deserialization is a class of vulnerability that occurs when an application takes untrusted data and uses it to reconstruct an object without sufficient validation. In environments using Python, the pickle module is frequently used for object serialization. When an application deserializes a crafted pickle file, the process can be manipulated to execute arbitrary code during the object reconstruction phase, specifically by leveraging the __reduce__ method.

In general terms, this type of flaw allows an attacker to bypass standard application logic. By providing a malicious payload, the attacker forces the underlying interpreter to perform unintended actions. This often results in the execution of system-level commands, effectively turning a data processing feature into a remote execution vector.

How to Protect Your Systems

• Update ComfyUI to the latest version immediately to incorporate the provided fix.
• Restrict access to the /upload/image and /prompt endpoints by placing the application behind a secure reverse proxy or VPN.
• Avoid exposing ComfyUI instances directly to the public internet.
• Implement network segmentation to ensure that even if the application is compromised, the attacker's ability to pivot to other sensitive systems is limited.
• Monitor server logs for unusual POST requests to the /upload/image or /prompt endpoints that may indicate exploitation attempts.

Given the critical risk associated with this vulnerability and the ease of exploitation, applying the vendor patch is the most effective way to secure your environment. Leaving vulnerable systems exposed creates a direct path for attackers to gain unauthorized access to your infrastructure. Prioritizing this update is essential to maintaining the integrity and security of your local or networked deployments.