Unpatched RCE flaw hits ComfyUI-Easy-Use extension

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

CVE-2026-123790 lets unauthenticated attackers overwrite a ComfyUI-Easy-Use custom node to achieve remote code execution; no patch exists.

Sourcekb.cert.org — open the original

CERT/CC published VU#944667 describing an unauthenticated remote code execution vulnerability in ComfyUI-Easy-Use version 1.3.6, a popular extension for the ComfyUI generative AI workflow interface. The flaw resides in the save_preview() handler, which can be abused by an attacker to upload a malicious Python file into ComfyUI's input directory and then overwrite an installed custom node's __init__.py file. When ComfyUI restarts, it automatically imports and executes the attacker-controlled Python code.

Exploitation requires no authentication or user interaction, only network reachability to the affected routes. A successful attack grants arbitrary Python and OS command execution with the privileges of the ComfyUI process, enabling an attacker to read/modify models and workflows and harvest credentials from the process environment. The maintainer of ComfyUI-Easy-Use could not be reached to coordinate a fix, so no patch is currently available.

Defenders running ComfyUI with the ComfyUI-Easy-Use extension should either remove the extension entirely or ensure the ComfyUI instance is not exposed to untrusted networks — restricting access to trusted users/IPs is the only mitigation offered. There is no indication in this advisory of active in-the-wild exploitation; this is a disclosure of a researcher-reported flaw (credited to Nguyen Huy Hoang) rather than a report of observed attacks.

title: Python Process Writes Custom Node __init__.py Under ComfyUI
description: Detects python.exe or pythonw.exe writing an __init__.py inside a ComfyUI
  custom_nodes directory. The ComfyUI-Easy-Use save_preview() flaw lets an attacker
  overwrite a custom node __init__.py so that attacker Python code is imported when
  ComfyUI restarts.
tags:
- attack.execution
- attack.t1059.006
- attack.persistence
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \python.exe
    - \pythonw.exe
    TargetFilename|contains|all:
    - comfyui
    - \custom_nodes\
    TargetFilename|endswith: \__init__.py
  condition: selection
falsepositives:
- Custom node installation or update through ComfyUI-Manager or pip-based install
  scripts
- Developers editing their own custom nodes with Python tooling
level: medium
id: d3fd0a2a-0026-584e-899d-ef350c84cbd1
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/944667

title: Python Script Written Into ComfyUI Input Directory
description: Detects a .py file created in the ComfyUI input directory by a python
  process. In the ComfyUI-Easy-Use save_preview() exploit, the attacker uploads a
  malicious Python file there before using it to overwrite a custom node __init__.py.
  The input directory normally holds images, video and audio.
tags:
- attack.command-and-control
- attack.t1105
- attack.execution
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \python.exe
    - \pythonw.exe
    TargetFilename|contains|all:
    - comfyui
    - \input\
    TargetFilename|endswith: .py
  condition: selection
falsepositives:
- Users uploading Python helper scripts through the ComfyUI UI for workflow experiments
level: medium
id: 8ee6fac7-e22c-5103-8be6-511730552b4a
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/944667

title: ComfyUI Python Process Spawning Shell or Download Utility
description: Detects a python process running ComfyUI main.py that spawns cmd, PowerShell,
  script hosts or common download utilities. After a custom node __init__.py is overwritten,
  the attacker code runs with the ComfyUI process privileges and can execute arbitrary
  OS commands.
tags:
- attack.execution
- attack.t1059.006
- attack.t1059.003
- attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \python.exe
    - \pythonw.exe
    ParentCommandLine|contains|all:
    - comfyui
    - main.py
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \curl.exe
  condition: selection_parent and selection_child
falsepositives:
- Custom nodes that legitimately shell out to cmd or curl for model downloads
- Administrators using ComfyUI-Manager scripts that invoke a shell
level: medium
id: 249533ed-fdb7-5c54-b52f-50d23177084c
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/944667

Source reporting: https://kb.cert.org/vuls/id/944667

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.