{"id":"PYSEC-2026-1260","summary":"ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler","details":"## Impact\n\n**Vulnerability Type**: CRLF Injection via ConfigParser\n\nAn attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the `config.ini` file. This can lead to security setting tampering or modification of application behavior.\n\n**Affected Users**: Users running ComfyUI-Manager in environments where ComfyUI is configured with the `--listen` option to allow remote access.\n\n**CVSS Score**: 7.5 (High)\n\n## Patches\n\nFixed in the following versions:\n- **3.39.2** (v3.x branch)\n- **4.0.5** (v4.x branch)\n\nSanitization logic was added to the `write_config()` function to remove CRLF and NULL characters from all string values.\n\n## Workarounds\n\nIf upgrading is not possible:\n- Run ComfyUI-Manager only on trusted networks\n- Block external access via firewall\n- Run on localhost only without the `--listen` option\n\n## References\n\n- [CWE-93: Improper Neutralization of CRLF Sequences](https://cwe.mitre.org/data/definitions/93.html)\n- [OWASP CRLF Injection](https://owasp.org/www-community/vulnerabilities/CRLF_Injection)\n\n## Credit\n\nThis vulnerability was reported by:\n- 李存义 \u003cxiaoheihei1107@gmail.com\u003e\n- D0n9 Li \u003cwyd0n9@gmail.com\u003e\n- Swings \u003cswing@mail.exp.sh\u003e\n- Osword from SGLAB of Legendsec at Qi'anxin Group \u003czhzhdoai@gmail.com\u003e","aliases":["CVE-2026-22777","GHSA-562r-8445-54r2"],"modified":"2026-07-07T17:47:26.783426244Z","published":"2026-07-07T16:03:18.326519Z","references":[{"type":"WEB","url":"https://github.com/Comfy-Org/ComfyUI-Manager/security/advisories/GHSA-562r-8445-54r2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22777"},{"type":"WEB","url":"https://github.com/Comfy-Org/ComfyUI-Manager/commit/ef8703a3d7ab4e6ecda8f96e0c5816c23d1cb262"},{"type":"WEB","url":"https://github.com/Comfy-Org/ComfyUI-Manager/commit/f4fa394e0f03b013f1068c96cff168ad10bd0410"},{"type":"PACKAGE","url":"https://github.com/Comfy-Org/ComfyUI-Manager"},{"type":"PACKAGE","url":"https://pypi.org/project/comfy-cli"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-562r-8445-54r2"}],"affected":[{"package":{"name":"comfy-cli","ecosystem":"PyPI","purl":"pkg:pypi/comfy-cli"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.2"},{"introduced":"4.0.0"},{"fixed":"4.0.5"}]}],"versions":["0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.20","0.0.20.dev0","0.0.20.dev1","0.0.21","0.0.21.dev0","0.0.21.dev1","0.0.21.dev13","0.0.21.dev14","0.0.21.dev2","0.0.21.dev3","0.0.21.dev4","0.0.21.dev8","0.0.21.dev9","0.0.22","0.0.23","0.0.24","0.0.25","0.0.26","0.0.28","0.0.29","0.0.31","0.0.32","0.0.8","0.0.9","1.0.32","1.0.33","1.0.34","1.0.35","1.0.36","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.10.5","1.11.1","1.12.0","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9","1.4.0","1.4.1","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.6.0","1.6.1","1.7.0","1.7.1","1.7.2","1.7.3","1.8.0","1.9.0"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/comfy-cli/PYSEC-2026-1260.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}