PT-2025-25518 · Comfyui · Comfyui

Gavin Zhong + 2 · Published 2025-06-16 · Updated 2025-06-16 · CVE-2025-6107

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions comfyanonymous comfyui version 0.3.40

Description A vulnerability was found in the function set attr of the file /comfy/utils.py, which can lead to dynamically-determined object attributes. The attack can be launched remotely, but it has a high complexity and is considered difficult to exploit. The exploit has been disclosed to the public.

Recommendations For version 0.3.40, consider disabling the set attr function in the /comfy/utils.py file as a temporary workaround until a patch is available. Restrict access to the /comfy/utils.py file to minimize the risk of exploitation. Avoid using the set attr function remotely until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-913

CWE-915

Related Identifiers

CVE-2025-6107

Affected Products

Comfyui

References · 9

• 🔥 https://gist.github.com/superboy-zjc/f71b84ed074260a5e459581caa2f1fb2#proof-of-concept · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-6107 · Security Note
• https://t.me/cvetracker/26278 · Telegram Post
• https://vuldb.com/?submit.590921 · Note
• https://gist.github.com/superboy-zjc/f71b84ed074260a5e459581caa2f1fb2 · Note
• https://vuldb.com/?id.312576 · Note
• https://twitter.com/CVEnew/status/1934487535612498016 · Twitter Post
• https://t.me/cvenotify/125742 · Telegram Post
• https://vuldb.com/?ctiid.312576 · Note