CVE-2026-22777High· 7.5▾ MidnightPoC availableComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.3%
0.3% → 0.3%
Last analysed / modified upstream
1 GitHub repo
Vulnerability Type: CRLF Injection via ConfigParser
An attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the config.ini file. This can lead to security setting tampering or modification of application behavior.
Affected Users: Users running ComfyUI-Manager in environments where ComfyUI is configured with the --listen option to allow remote access.
CVSS Score: 7.5 (High)
Fixed in the following versions:
Sanitization logic was added to the write_config() function to remove CRLF and NULL characters from all string values.
If upgrading is not possible:
--listen optionThis vulnerability was reported by:
comfy-cli >= 4.0.0, < 4.0.5comfy-cli < 3.39.2Upgrade to a patched release:
comfy-cli 4.0.5comfy-cli 3.39.2Field changes observed since this record was first indexed.