PatchSiren cyber security CVE debrief
CVE-2026-56670 Comfy-Org CVE debrief
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T06:16:27.560Z and has not been modified since then. CVE-2026-56670 is a HIGH severity vulnerability in ComfyUI, a modular diffusion model GUI, api and backend. The /view endpoint served uploaded SVG files inline due to missing dangerous-content-type handling for image/svg+xml and related XML content types, allowing stored cross-site scripting in the ComfyUI origin. This issue is fixed in version 0.28.0. Evidence limits suggest that defenders verify content handling and user-uploaded data. Users of ComfyUI versions prior to 0.28.0, developers and administrators handling user-uploaded content, and security teams should review and apply the security patch immediately. They should also review their content security policies and ensure proper handling of SVG and XML content types.
- Vendor
- Comfy-Org
- Product
- ComfyUI
- CVSS
- HIGH 8.2
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-31
- Original CVE updated
- 2026-07-31
- Advisory published
- 2026-07-31
- Advisory updated
- 2026-07-31
Who should care
Users of ComfyUI versions prior to 0.28.0, developers and administrators handling user-uploaded content, and security teams should review and apply the security patch immediately. They should also review their content security policies and ensure proper handling of SVG and XML content types.
Technical summary
CVE-2026-56670 is a HIGH severity vulnerability in ComfyUI, a modular diffusion model GUI, api and backend. The /view endpoint served uploaded SVG files inline due to missing dangerous-content-type handling for image/svg+xml and related XML content types, allowing stored cross-site scripting in the ComfyUI origin. This issue is fixed in version 0.28.0. The vulnerability has a CVSS score of 8.2 and is rated HIGH. Users of ComfyUI versions prior to 0.28.0 should apply the security patch immediately. Developers and administrators handling user-uploaded content should review their content security policies and ensure proper handling of SVG and XML content types. The issue involves stored cross-site scripting in ComfyUI due to the /view endpoint serving uploaded SVG files inline without proper content type handling.
Defensive priority
CVE-2026-56670 is rated HIGH with a CVSS score of 8.2; immediate review is recommended.
Recommended defensive actions
- Review and apply patch version 0.28.0 or later for ComfyUI
- Restrict upload and serving of SVG files
- Implement additional content security policies
- Monitor for suspicious activity related to /view endpoint
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
Evidence notes
The CVE-2026-56670 issue involves stored cross-site scripting in ComfyUI due to the /view endpoint serving uploaded SVG files inline without proper content type handling. The vulnerability has a CVSS score of 8.2 and is rated HIGH. Users of ComfyUI versions prior to 0.28.0 should apply the security patch immediately. Developers and administrators handling user-uploaded content should review their content security policies and ensure proper handling of SVG and XML content types. The issue is fixed in version 0.28.0. Evidence limits suggest that defenders verify content handling and user-uploaded data.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T06:16:27.560Z and has not been modified since then.