CVE-2024-10099: Stored XSS in comfyanonymous/comfyui
A stored cross-site scripting (XSS) vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier. The vulnerability occurs when an attacker uploads an HTML file containing a malicious XSS payload via the /api/upload/image endpoint. The payload is executed when the file is viewed through the /view API endpoint, leading to potential execution of arbitrary JavaScript code.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10099?
CVE-2024-10099 is classified as a stored cross-site scripting (XSS) vulnerability.
How do I fix CVE-2024-10099?
To fix CVE-2024-10099, upgrade ComfyUI to version 0.2.3 or later, which addresses this vulnerability.
What components are affected by CVE-2024-10099?
CVE-2024-10099 affects ComfyUI version 0.2.2 and potentially earlier versions.
How does CVE-2024-10099 exploit the application?
CVE-2024-10099 exploits the application by allowing attackers to upload a malicious HTML file that executes an XSS payload.
What impact does CVE-2024-10099 have on users?
CVE-2024-10099 can lead to unauthorized actions being performed on behalf of users and data theft due to XSS.