Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
comfy-org/comfyui
master @ 5236cd0
22
Fixes
3
CVEs
HIGH
Peak severity
38.1%
Coverage
Highlights
Path Traversal: 7 prior fixes. Scrutinize any change in this area.
server.py: most-fixed (5 issues). Treat as high-risk during review.
13 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Path validation mechanisms in image and file management endpoints historically used insufficient containment checks (such as using os.path.abspath instead of os.path.realpath), allowing attackers to bypass directory restrictions and write or read arbitrary system files.
Cross-Origin Request Forgery: The application lacked host/origin matching controls on highly privileged endpoints, exposing local and remote deployments to CSRF and origin-verification bypasses.
Reflected XSS: Serving stored or uploaded files with executable or renderable MIME types enabled inline execution of arbitrary scripts, bypassing standard containment mechanisms.