CVE-2026-22777High· 7.5▾ TwilightComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.3%
0.3% → 0.3%
Last analysed / modified upstream
Vulnerability Type: CRLF Injection via ConfigParser
An attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the config.ini file. This can lead to security setting tampering or modification of application behavior.
Affected Users: Users running ComfyUI-Manager in environments where ComfyUI is configured with the --listen option to allow remote access.
CVSS Score: 7.5 (High)
Fixed in the following versions:
Sanitization logic was added to the write_config() function to remove CRLF and NULL characters from all string values.
If upgrading is not possible:
--listen optionThis vulnerability was reported by:
comfy-cli >= 4.0.0, < 4.0.5comfy-cli < 3.39.2Upgrade to a patched release:
comfy-cli 4.0.5comfy-cli 3.39.2