{"id":"GHSA-562r-8445-54r2","summary":"ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler","details":"## Impact\n\n**Vulnerability Type**: CRLF Injection via ConfigParser\n\nAn attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the `config.ini` file. This can lead to security setting tampering or modification of application behavior.\n\n**Affected Users**: Users running ComfyUI-Manager in environments where ComfyUI is configured with the `--listen` option to allow remote access.\n\n**CVSS Score**: 7.5 (High)\n\n## Patches\n\nFixed in the following versions:\n- **3.39.2** (v3.x branch)\n- **4.0.5** (v4.x branch)\n\nSanitization logic was added to the `write_config()` function to remove CRLF and NULL characters from all string values.\n\n## Workarounds\n\nIf upgrading is not possible:\n- Run ComfyUI-Manager only on trusted networks\n- Block external access via firewall\n- Run on localhost only without the `--listen` option\n\n## References\n\n- [CWE-93: Improper Neutralization of CRLF Sequences](https://cwe.mitre.org/data/definitions/93.html)\n- [OWASP CRLF Injection](https://owasp.org/www-community/vulnerabilities/CRLF_Injection)\n\n## Credit\n\nThis vulnerability was reported by:\n- 李存义 \u003cxiaoheihei1107@gmail.com\u003e\n- D0n9 Li \u003cwyd0n9@gmail.com\u003e\n- Swings \u003cswing@mail.exp.sh\u003e\n- Osword from SGLAB of Legendsec at Qi'anxin Group \u003czhzhdoai@gmail.com\u003e","aliases":["CVE-2026-22777","PYSEC-2026-1260"],"modified":"2026-09-10T03:49:54.341494095Z","published":"2026-01-13T19:02:52Z","database_specific":{"nvd_published_at":"2026-01-10T07:16:03Z","cwe_ids":["CWE-93"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-01-13T19:02:52Z"},"references":[{"type":"WEB","url":"https://github.com/Comfy-Org/ComfyUI-Manager/security/advisories/GHSA-562r-8445-54r2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22777"},{"type":"WEB","url":"https://github.com/Comfy-Org/ComfyUI-Manager/commit/ef8703a3d7ab4e6ecda8f96e0c5816c23d1cb262"},{"type":"WEB","url":"https://github.com/Comfy-Org/ComfyUI-Manager/commit/f4fa394e0f03b013f1068c96cff168ad10bd0410"},{"type":"PACKAGE","url":"https://github.com/Comfy-Org/ComfyUI-Manager"}],"affected":[{"package":{"name":"comfy-cli","ecosystem":"PyPI","purl":"pkg:pypi/comfy-cli"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.5"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 4.0.4","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-562r-8445-54r2/GHSA-562r-8445-54r2.json"}},{"package":{"name":"comfy-cli","ecosystem":"PyPI","purl":"pkg:pypi/comfy-cli"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.2"}]}],"versions":["0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.20","0.0.20.dev0","0.0.20.dev1","0.0.21","0.0.21.dev0","0.0.21.dev1","0.0.21.dev13","0.0.21.dev14","0.0.21.dev2","0.0.21.dev3","0.0.21.dev4","0.0.21.dev8","0.0.21.dev9","0.0.22","0.0.23","0.0.24","0.0.25","0.0.26","0.0.28","0.0.29","0.0.31","0.0.32","0.0.8","0.0.9","1.0.32","1.0.33","1.0.34","1.0.35","1.0.36","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.10.5","1.11.1","1.12.0","1.13.0","1.14.0","1.15.0","1.16.0","1.17.0","1.18.0","1.19.0","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9","1.20.0","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9","1.4.0","1.4.1","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.6.0","1.6.1","1.7.0","1.7.1","1.7.2","1.7.3","1.8.0","1.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-562r-8445-54r2/GHSA-562r-8445-54r2.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}