id: PYSEC-2026-1260
published: "2026-07-07T16:03:18.326519Z"
modified: "2026-07-07T17:23:56.545078Z"
aliases:
- CVE-2026-22777
- GHSA-562r-8445-54r2
summary: ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler
details: "## Impact\n\n**Vulnerability Type**: CRLF Injection via ConfigParser\n\nAn attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the `config.ini` file. This can lead to security setting tampering or modification of application behavior.\n\n**Affected Users**: Users running ComfyUI-Manager in environments where ComfyUI is configured with the `--listen` option to allow remote access.\n\n**CVSS Score**: 7.5 (High)\n\n## Patches\n\nFixed in the following versions:\n- **3.39.2** (v3.x branch)\n- **4.0.5** (v4.x branch)\n\nSanitization logic was added to the `write_config()` function to remove CRLF and NULL characters from all string values.\n\n## Workarounds\n\nIf upgrading is not possible:\n- Run ComfyUI-Manager only on trusted networks\n- Block external access via firewall\n- Run on localhost only without the `--listen` option\n\n## References\n\n- [CWE-93: Improper Neutralization of CRLF Sequences](https://cwe.mitre.org/data/definitions/93.html)\n- [OWASP CRLF Injection](https://owasp.org/www-community/vulnerabilities/CRLF_Injection)\n\n## Credit\n\nThis vulnerability was reported by:\n- 李存义 <xiaoheihei1107@gmail.com>\n- D0n9 Li <wyd0n9@gmail.com>\n- Swings <swing@mail.exp.sh>\n- Osword from SGLAB of Legendsec at Qi'anxin Group <zhzhdoai@gmail.com>"
affected:
- package:
    name: comfy-cli
    ecosystem: PyPI
    purl: pkg:pypi/comfy-cli
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 3.39.2
    - introduced: 4.0.0
    - fixed: 4.0.5
  versions:
  - 0.0.10
  - 0.0.11
  - 0.0.12
  - 0.0.13
  - 0.0.14
  - 0.0.15
  - 0.0.16
  - 0.0.17
  - 0.0.18
  - 0.0.19
  - 0.0.20
  - 0.0.20.dev0
  - 0.0.20.dev1
  - 0.0.21
  - 0.0.21.dev0
  - 0.0.21.dev1
  - 0.0.21.dev13
  - 0.0.21.dev14
  - 0.0.21.dev2
  - 0.0.21.dev3
  - 0.0.21.dev4
  - 0.0.21.dev8
  - 0.0.21.dev9
  - 0.0.22
  - 0.0.23
  - 0.0.24
  - 0.0.25
  - 0.0.26
  - 0.0.28
  - 0.0.29
  - 0.0.31
  - 0.0.32
  - 0.0.8
  - 0.0.9
  - 1.0.32
  - 1.0.33
  - 1.0.34
  - 1.0.35
  - 1.0.36
  - 1.1.0
  - 1.1.1
  - 1.1.2
  - 1.1.3
  - 1.1.4
  - 1.1.5
  - 1.1.6
  - 1.1.7
  - 1.1.8
  - 1.10.0
  - 1.10.1
  - 1.10.2
  - 1.10.3
  - 1.10.4
  - 1.10.5
  - 1.11.1
  - 1.12.0
  - 1.2.0
  - 1.2.1
  - 1.2.2
  - 1.2.3
  - 1.2.4
  - 1.2.5
  - 1.2.6
  - 1.2.7
  - 1.2.8
  - 1.2.9
  - 1.3.0
  - 1.3.1
  - 1.3.2
  - 1.3.3
  - 1.3.4
  - 1.3.5
  - 1.3.6
  - 1.3.7
  - 1.3.8
  - 1.3.9
  - 1.4.0
  - 1.4.1
  - 1.5.0
  - 1.5.1
  - 1.5.2
  - 1.5.3
  - 1.5.4
  - 1.6.0
  - 1.6.1
  - 1.7.0
  - 1.7.1
  - 1.7.2
  - 1.7.3
  - 1.8.0
  - 1.9.0
references:
- type: WEB
  url: https://github.com/Comfy-Org/ComfyUI-Manager/security/advisories/GHSA-562r-8445-54r2
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2026-22777
- type: WEB
  url: https://github.com/Comfy-Org/ComfyUI-Manager/commit/ef8703a3d7ab4e6ecda8f96e0c5816c23d1cb262
- type: WEB
  url: https://github.com/Comfy-Org/ComfyUI-Manager/commit/f4fa394e0f03b013f1068c96cff168ad10bd0410
- type: PACKAGE
  url: https://github.com/Comfy-Org/ComfyUI-Manager
- type: PACKAGE
  url: https://pypi.org/project/comfy-cli
- type: ADVISORY
  url: https://github.com/advisories/GHSA-562r-8445-54r2
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N