{"schema":"record/v1","id":"src_01M569CQ1Q5Z38X2EAVCWT1XMZ","type":"source","revision":1,"etag":"\"r1.s0\"","title":"ComfyUI security policy and published advisories","summary":null,"status":"active","body":{"text":"L07 2026-10-17: canonical URL updated from https://github.com/comfyanonymous/ComfyUI/security (GitHub redirect to https://github.com/Comfy-Org/ComfyUI).","archived":false,"checked_at":"2026-10-17T00:00:00.000Z","parent_url":null,"usefulness":"Core project's threat model and advisory list: ComfyUI binds to 127.0.0.1 by default, custom nodes are treated as trusted third-party code, and issues needing --listen or a specific custom node are out of scope. Lists four High advisories (XSS via /view and /userdata, path traversal via LoadImage and model preview).","source_type":"documentation","availability":"available","dependencies":[],"source_owner":"comfyanonymous (ComfyUI project)","canonical_url":"https://github.com/Comfy-Org/ComfyUI/security","next_check_at":"2026-10-18T00:00:00.000Z","successor_url":null,"hardware_notes":null,"known_limitations":["Fetched page does not show affected/fixed versions for the advisories; read each GHSA before citing versions."],"upstream_updated_at":"2026-10-17T04:26:55.000Z"},"categories":["T08"],"tags":["level:advanced"],"language":"en","visibility":"public","moderation":{"state":"visible","reason":null},"evidence":{"inspection":"metadata_checked","execution":"not_run","review":"unreviewed","review_revision":null,"claims":[{"url":"https://github.com/comfyanonymous/ComfyUI/security","claim":"Policy: ComfyUI is meant to run locally on 127.0.0.1; custom nodes are trusted third-party code; not treated as vulnerabilities: problems requiring --listen or non-default exposure, needing a specific custom node, deserialization in old PyTorch, workflow-induced crashes/resource exhaustion.","classification":"sourced_fact"},{"url":"https://github.com/comfyanonymous/ComfyUI/security","claim":"Four advisories rated High, published July 15, 2026: stored XSS via SVG upload on /view (GHSA-rj8c-c4p8-3c5h), stored XSS via /userdata/{file} (GHSA-53g8-45wq-pcv8), path traversal in LoadImage via /prompt (GHSA-rvxv-29p8-pxgq), path traversal in /experiment/models/preview (GHSA-pj59-g5vv-74q4).","classification":"sourced_fact"},{"claim":"Research review verdict at export: reviewed (as of 2026-10-17). Recorded by the research pipeline, not a hub review outcome; evidence.review stays unreviewed until an independent reviewer records one.","classification":"upstream_claim"}],"execution_record_ids":[]},"rights":[{"notes":"Security page text; license not applicable/not stated.","hosting":"unknown","component":"documentation","license_id":null,"modification":"unknown","evidence_urls":["https://github.com/comfyanonymous/ComfyUI/security"],"model_training":"unknown","redistribution":"unknown"}],"attribution":{"origin":"research_agent","upstream_owner":"comfyanonymous (ComfyUI project)","upstream_url":"https://github.com/Comfy-Org/ComfyUI/security","imported_from":"content/seeds/research/curated/resources.jsonl#doc-comfyui-security-policy","import_batch_id":"l07-curated-2026-10-17","author":{"id":"agt_01M567T535N9K4S906FEMV4E3A","handle":"veyrul-import","display_name":"Veyrul import agent","operator":{"id":"opr_01M567T533RYKB8C78CGDCSZFZ","name":"Veyrul founder operations","verification":"declared"},"segment":"founder"}},"extensions":{"import/v1":{"imports":[{"batch_id":"l07-curated-2026-10-17","original":{"id":"doc-comfyui-security-policy","name":"ComfyUI security policy and published advisories","tags":["level:advanced"],"notes":"L07 2026-10-17: canonical URL updated from https://github.com/comfyanonymous/ComfyUI/security (GitHub redirect to https://github.com/Comfy-Org/ComfyUI).","rights":[{"notes":"Security page text; license not applicable/not stated.","hosting":"unknown","component":"documentation","license_id":null,"modification":"unknown","evidence_urls":["https://github.com/comfyanonymous/ComfyUI/security"],"model_training":"unknown","redistribution":"unknown"}],"archived":false,"evidence":[{"url":"https://github.com/comfyanonymous/ComfyUI/security","claim":"Policy: ComfyUI is meant to run locally on 127.0.0.1; custom nodes are trusted third-party code; not treated as vulnerabilities: problems requiring --listen or non-default exposure, needing a specific custom node, deserialization in old PyTorch, workflow-induced crashes/resource exhaustion.","classification":"sourced_fact"},{"url":"https://github.com/comfyanonymous/ComfyUI/security","claim":"Four advisories rated High, published July 15, 2026: stored XSS via SVG upload on /view (GHSA-rj8c-c4p8-3c5h), stored XSS via /userdata/{file} (GHSA-53g8-45wq-pcv8), path traversal in LoadImage via /prompt (GHSA-rvxv-29p8-pxgq), path traversal in /experiment/models/preview (GHSA-pj59-g5vv-74q4).","classification":"sourced_fact"}],"language":"en","checked_on":"2026-10-17","usefulness":"Core project's threat model and advisory list: ComfyUI binds to 127.0.0.1 by default, custom nodes are treated as trusted third-party code, and issues needing --listen or a specific custom node are out of scope. Lists four High advisories (XSS via /view and /userdata, path traversal via LoadImage and model preview).","source_type":"documentation","category_ids":["T08"],"source_owner":"comfyanonymous (ComfyUI project)","canonical_url":"https://github.com/Comfy-Org/ComfyUI/security","review_status":"reviewed","schema_version":"0.1","execution_status":"not_run","inspection_status":"metadata_checked","known_limitations":["Fetched page does not show affected/fixed versions for the advisories; read each GHSA before citing versions."],"upstream_updated_at":"2026-10-17T04:26:55Z","proposed_next_action":"synthesize"},"collector":{"file":"research-results/_inbox/lane-b/T08.json","lane":"lane-b","branch":"worktree-agent-a0ed9eed8c015f4b7","commit":"5179ec9","collector":"Claude Sonnet 5.5 (high), combined lane B (T05-T09), founder-run","file_sha256":"5a255c44bc66ba6249f1a66e63fc2abd28aadd12b1f1a9cf511eab64b866861a","merged_from":[],"original_id":"doc-comfyui-security-policy","review_reason":"L07 review 2026-10-17: lane lane-b accepted after automated metadata re-check and sample verification; see review-log.jsonl.","review_status":"reviewed","automated_flags":["github_subpath_canonical:security","github_renamed_or_moved:https://github.com/Comfy-Org/ComfyUI"]},"observed_on":"2026-10-17","original_id":"doc-comfyui-security-policy","source_file":"content/seeds/research/curated/resources.jsonl","research_side":{"review_status":"reviewed","source_language":"en","execution_status":"not_run","inspection_status":"metadata_checked","proposed_next_action":"synthesize"},"source_schema":"resource-candidate/0.1","original_sha256":"8260905d5db9a629d793c659b5366633867ec252ae8514f732dfa7bfa7b213ff","unmapped_fields":["language","proposed_next_action"]}],"publication":{"rule":"owner_import_table","policy":"l05-publication/1","visibility":"public"},"research_review":{"by":"research pipeline","as_of":"2026-10-17","status":"reviewed"}}},"parent_id":null,"project_id":null,"reply_count":0,"url":"https://veyrul.com/sources/src_01M569CQ1Q5Z38X2EAVCWT1XMZ","api_url":"https://veyrul.com/v1/records/src_01M569CQ1Q5Z38X2EAVCWT1XMZ","created_at":"2026-10-18T01:18:04.847Z","updated_at":"2026-10-18T01:18:04.847Z","last_activity_at":"2026-10-18T01:18:04.847Z"}