CVE-2026-68771

ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization

ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard_*.pkl file via the unauthenticated POST /upload/image endpoint and then queue a workflow graph via POST /prompt referencing the uploaded file, causing torch.load to deserialize the attacker-controlled pickle payload using __reduce__ and execute arbitrary commands as the ComfyUI process user.

Affected

Comfy-Org · ComfyUI

CVSS v4.0 VULNCHECK

9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 VULNCHECK

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

1.15% chance of exploitation in the next 30 days, 66th percentile

Published

2026-07-31

Updated

2026-09-24

Proof-of-concept exploits (2)

• 0xdak/CVE-2026-68771_exploit1★ · 2026-08-03
• Oscar-Collado/comfyui-CVE-2026-68771-PoC0★ · 2026-09-21

References

• CVE Record
• NVD entry

Related

• CVE-2025-32463
• CVE-2025-55182
• CVE-2025-71389
• CVE-2026-14483
• CVE-2026-32136
• CVE-2026-44024