CVE-2026-22777
High
Description
ComfyUI-Manager is an extension designed to enhance the usability of ComfyUI. Prior to versions 3.39.2 and 4.0.5, an attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the config.ini file. This can lead to security setting tampering or modification of application behavior. This issue has been patched in versions 3.39.2 and 4.0.5.
SeverityHigh
CVSS7.5
Exploit probability—
ProductComfyui-manager
PublishedJan 10, 2026
First seenJan 10, 2026
Weakness typeCWE-93CWE-93
How to fix
Update
- comfy comfyui-manager3.39.2, 4.0.5 or later
- comfy-cli4.0.5, 3.39.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| comfy comfyui-manager | v < 3.39.2, 4.0.3 ≤ v < 4.0.5 | 3.39.2, 4.0.5 |
| comfy-cliPyPI | 4.0.0 ≤ v < 4.0.5, v < 3.39.2 | 4.0.5, 3.39.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.