CVE-2026-68771_exploit

CVE-2026-68771 — ComfyUI Unauthenticated Pickle Deserialization RCE Unauthenticated remote code execution in ComfyUI via the LoadTrainingDataset node. LoadTrainingDataset.execute loads dataset shards from the server's output directory with torch.loadf and noweightsonly=True. On PyTorch /tmp/pwned...

Exploit for CVE-2026-68771

CVE-2026-68771 — ComfyUI: Unauthenticated RCE via Insecure Des...

Exploit for CVE-2026-68771

CVE-2026-68771 — ComfyUI Unauthenticated Pickle Deserializatio...

CVE-2026-68771

ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard.pkl file via...

CVE-2026-68771

Technical details about this CVE are not publicly available in the provided documents. Monitor for updates from the vendor and CVE databases for affected versions, impact, and remediation.

CVE-2026-68771 ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization

ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard.pkl file via...

CVE-2026-68771: Deserialization of Untrusted Data

ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard.pkl file via...