CVE-2026-108962: storyicon comfyui_segment_anything GroundingDINO Model Loading slconfig.py SLConfig._file2dict code injection
A vulnerability has been found in storyicon comfyuisegmentanything up to ab6395596399d5048639cdab7e44ec9fae857a93. Affected by this issue is the function SLConfig.file2dict of the file localgroundingdino/util/slconfig.py of the component GroundingDINO Model Loading. Such manipulation of the argument config leads to code injection. It is possible to launch the attack remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require an authenticated account or user action?
The CVSS vector indicates no privileges are required, but user interaction is required. The attack can be launched remotely.
How can I determine whether my deployment is affected?
Deployments using storyicon comfyui_segment_anything at or before commit ab6395596399d5048639cdab7e44ec9fae857a93 are reported as affected. Because the project uses rolling releases, affected and fixed version numbers are not available.
Is a vendor fix available?
The available information does not identify an updated release or fix. The project was reportedly notified through an issue report but had not responded at the time of publication.