ComfyUI Cross-Site Scripting Vulnerability in Image Upload Component

A cross-site scripting (XSS) vulnerability has been identified in ComfyUI versions through 0.3.39. This issue arises from an incomplete fix for a previous vulnerability (CVE-2024-10099) in the image upload functionality. The vulnerability allows remote attackers to manipulate the 'image' argument, leading to the execution of malicious JavaScript payloads. The exploitation requires user interaction, such as uploading a file via the image upload feature.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, upload a file with a supported extension that can execute JavaScript, such as .svg or .xhtml, through the image upload feature. The uploaded file can contain a script payload, such as a JavaScript alert, which will be executed, demonstrating the cross-site scripting vulnerability.