Vulnerability · Published Jun 16, 2025 · Assigned by VulDB

CVE-2025-6107comfyanonymous comfyui utils.py set_attr dynamically-determined object attributes

Low 3.1

In plain English

A low-severity security flaw in comfyui from comfyanonymous. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.4%top 61.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in comfyanonymous comfyui 0.3.40. It has been classified as problematic. Affected is the function set_attr of the file /comfy/utils.py. The manipulation leads to dynamically-determined object attributes. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
comfyanonymous	comfyui	0.3.40

Weakness: CWE-915, CWE-913 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R

References

VDB-312576 | comfyanonymous comfyui utils.py set_attr dynamically-determined object attributes vdb-entry, technical-description
VDB-312576 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #590921 | ComfyUI v0.3.40 Improperly Controlled Modification of Object Prototype Attribute third-party-advisory
https://gist.github.com/superboy-zjc/f71b84ed074260a5e459581caa2f1fb2 related
https://gist.github.com/superboy-zjc/f71b84ed074260a5e459581caa2f1fb2#proof-of-concept exploit