CERT/CC Warns ComfyUI-Easy-Use File Overwrite Can Lead to Code Execution
Tech GuruQuick Answer
Remove the extension or restrict ComfyUI access to trusted users while assessing the cited upstream fix. Inspect custom-node integrity before restarting a potentially exposed instance.
Confirm Scope And Apply The Supported Remediation
What to do now: Record installed extension version or commit, custom-node directories, network exposure, authentication and the ComfyUI process account. Determine whether upload and save_preview routes are reachable without authentication. Review the period of exposure and the permissions and credentials available to the process. Use CERT/CC mitigation: remove the extension or restrict access to trusted users. If deploying the main-branch fix, verify the exact cited commit is included and validate the build before restoring access. Compare custom-node files with trusted copies, review upload and request logs, and test access controls. Preserve suspicious files and deployment evidence; assess credential exposure if unauthorized changes are found.
Last verified: 2026-11-12 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | ComfyUI-Easy-Use custom-node extension |
|---|---|
| Advisory | VU#944667 |
| CVE | CVE-2026-123790 |
| Authoritative release date | November 12, 2026 at 14:48:14 UTC, from CERT/CC first-publication metadata. |
| Authority revision date | CERT/CC revision 2 was updated November 12, 2026 at 15:20:05 UTC. |
| Affected versions | ComfyUI-Easy-Use 1.4.1 and earlier, as reported by CERT/CC; remote attacks require network access to affected routes without authentication. |
| Fixed version | CERT/CC identifies main-branch commit 8a0f2fc412c1c6f9109e9392064800a87a706775; no fixed numbered release is specified |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | CERT/CC does not confirm exploitation in the wild.; no exploitation claim is inferred. |
What Changed
An unauthenticated path-traversal flaw can overwrite a custom-node Python file. The modified code executes when ComfyUI restarts. CERT/CC revision 2 identifies an upstream fix commit while vendor status remains Unknown.
What To Validate Now
- Inventory. Record installed extension version or commit, custom-node directories, network exposure, authentication and the ComfyUI process account.
- Establish applicability. Determine whether upload and save_preview routes are reachable without authentication. Review the period of exposure and the permissions and credentials available to the process.
- Remediate. Use CERT/CC mitigation: remove the extension or restrict access to trusted users. If deploying the main-branch fix, verify the exact cited commit is included and validate the build before restoring access.
- Validate. Compare custom-node files with trusted copies, review upload and request logs, and test access controls. Preserve suspicious files and deployment evidence; assess credential exposure if unauthorized changes are found.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
A restart can load an overwritten Python file. A software update alone does not establish that installed custom nodes are clean. Coordinate integrity review and recovery before restarting a potentially affected instance.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
