{"id":"CVE-2026-22777","aliases":["GHSA-562r-8445-54r2","PYSEC-2026-1260"],"url":"https://o3.security/vulnerability/CVE-2026-22777","summary":"ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler","details":"## Impact\n\n**Vulnerability Type**: CRLF Injection via ConfigParser\n\nAn attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the `config.ini` file. This can lead to security setting tampering or modification of application behavior.\n\n**Affected Users**: Users running ComfyUI-Manager in environments where ComfyUI is configured with the `--listen` option to allow remote access.\n\n**CVSS Score**: 7.5 (High)\n\n## Patches\n\nFixed in the following versions:\n- **3.39.2** (v3.x branch)\n- **4.0.5** (v4.x branch)\n\nSanitization logic was added to the `write_config()` function to remove CRLF and NULL characters from all string values.\n\n## Workarounds\n\nIf upgrading is not possible:\n- Run ComfyUI-Manager only on trusted networks\n- Block external access via firewall\n- Run on localhost only without the `--listen` option\n\n## References\n\n- [CWE-93: Improper Neutralization of CRLF Sequences](https://cwe.mitre.org/data/definitions/93.html)\n- [OWASP CRLF Injection](https://owasp.org/www-community/vulnerabilities/CRLF_Injection)\n\n## Credit\n\nThis vulnerability was reported by:\n- 李存义 <xiaoheihei1107@gmail.com>\n- D0n9 Li <wyd0n9@gmail.com>\n- Swings <swing@mail.exp.sh>\n- Osword from SGLAB of Legendsec at Qi'anxin Group <zhzhdoai@gmail.com>","published":"2026-01-10T06:43:21.579Z","modified":"2026-08-12T03:51:09.874663377Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"comfy-cli","fixedVersion":"4.0.5"},{"ecosystem":"PyPI","name":"comfy-cli","fixedVersion":"3.39.2"}],"fix":{"url":"https://github.com/Comfy-Org/ComfyUI-Manager/commit/f4fa394e0f03b013f1068c96cff168ad10bd0410","label":"Comfy-Org/ComfyUI-Manager@f4fa394"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22777.json"},{"type":"ADVISORY","url":"https://github.com/Comfy-Org/ComfyUI-Manager/security/advisories/GHSA-562r-8445-54r2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22777"},{"type":"FIX","url":"https://github.com/Comfy-Org/ComfyUI-Manager/commit/f4fa394e0f03b013f1068c96cff168ad10bd0410"},{"type":"WEB","url":"https://github.com/Comfy-Org/ComfyUI-Manager/commit/ef8703a3d7ab4e6ecda8f96e0c5816c23d1cb262"},{"type":"PACKAGE","url":"https://github.com/Comfy-Org/ComfyUI-Manager"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:09.874663377Z"}}