CVE-2026-22777 is a high severity vulnerability with a CVSS score of 7.5. No known exploits currently, and patches are available.
Very low probability of exploitation
EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.
Vulnerability Type: CRLF Injection via ConfigParser
An attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the config.ini file. This can lead to security setting tampering or modification of application behavior.
Affected Users: Users running ComfyUI-Manager in environments where ComfyUI is configured with the --listen option to allow remote access.
CVSS Score: 7.5 (High)
Fixed in the following versions:
Sanitization logic was added to the write_config() function to remove CRLF and NULL characters from all string values.
If upgrading is not possible:
--listen optionThis vulnerability was reported by:
Please cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.