Popular AI Tool Flaw Lets Anyone Run Code

A critical flaw in a popular ComfyUI extension lets attackers run any code on your server without needing a password.

A severe security vulnerability has been discovered in a popular extension for ComfyUI, a widely used open-source tool for building generative AI workflows. According to a report from the CERT Coordination Center (CERT/CC), the "ComfyUI-Easy-Use" extension contains a critical flaw that allows an unauthenticated attacker to execute arbitrary code on the host server. The vulnerability, tracked as VU#944667, affects version 1.3.6 of the extension. Given ComfyUI's popularity among developers and artists for creating complex image and video generation pipelines, this flaw exposes a significant number of users to the risk of a complete server compromise. An attacker who can reach the ComfyUI instance over a network can exploit this vulnerability without needing any login credentials, making it particularly dangerous for any systems that are even partially exposed to the internet.

The vulnerability stems from a function within the extension called `save_preview()`, which is intended to save preview images. However, the function fails to properly validate the file path provided by the user. This weakness allows an attacker to perform a "path traversal" attack by crafting a special request that uses characters like `../` to navigate outside of the intended destination folder. By doing so, an attacker can overwrite arbitrary files on the system that the ComfyUI process has permission to modify. The most effective attack vector involves overwriting a Python file belonging to another custom node. When the ComfyUI server is restarted, it automatically loads and executes the code in these custom node files. By replacing a legitimate file with malicious code, the attacker ensures their code will run, effectively giving them a persistent backdoor and full control over the machine.

This incident highlights a growing and often overlooked risk in the rapidly expanding AI ecosystem: the security of the software supply chain. ComfyUI, like many modern development tools, relies on a rich ecosystem of third-party extensions and plugins, known as custom nodes, to provide extended functionality. While this fosters rapid innovation and collaboration, it also creates a vast and fragmented attack surface. Each extension introduces new code that may not have undergone rigorous security auditing. This problem is not unique to AI and mirrors long-standing challenges in environments like WordPress plugins, npm packages, and browser extensions. As companies race to integrate generative AI, developers often pull in numerous open-source components without fully vetting their security posture, creating a hidden risk that a single vulnerable dependency can compromise an entire system.

For developers, security teams, and CTOs, this vulnerability serves as a critical reminder that securing AI infrastructure goes beyond protecting the models themselves. The entire toolchain, from development environments to deployment pipelines, must be hardened. The immediate action is to identify any instances of ComfyUI-Easy-Use and update them to a patched version. In the long term, organizations must adopt a more proactive security stance for their AI stacks. This includes maintaining a software bill of materials (SBOM) to track all components and dependencies, implementing automated vulnerability scanning, and adhering to the principle of least privilege by running services in sandboxed environments with limited permissions. As attackers increasingly target the valuable assets and compute resources of AI systems, securing the sprawling open-source software supply chain will become a central challenge for the industry.

This is an unauthenticated Remote Code Execution (RCE) vulnerability in a widely used AI workflow tool. Any internet-exposed ComfyUI instance with this extension is vulnerable to complete takeover, exposing sensitive models, data, and expensive compute resources to attackers.

A compromise could lead to theft of proprietary AI models, data breaches, or abuse of GPU resources for crypto mining. The resulting financial costs, operational downtime, and reputational damage pose a significant threat to businesses relying on this tool.