7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22777

CVE-2026-22777: ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler

ComfyUI-Manager is an extension designed to enhance the usability of ComfyUI. Prior to versions 3.39.2 and 4.0.5, an attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the config.ini file. This can lead to security setting tampering or modification of application behavior. This issue has been patched in versions 3.39.2 and 4.0.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22777

CVE-2026-22777:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
comfy-cli	pip	>= 4.0.0, <= 4.0.4	4.0.5
comfy-cli	pip	< 3.39.2	3.39.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-562r-8445-54r2, is a CRLF injection flaw in ComfyUI-Manager's configuration handler. The analysis of the provided patches confirms this. The two commits, ef8703a3d7ab4e6ecda8f96e0c5816c23d1cb262 for the v4.x branch and f4fa394e0f03b013f1068c96cff168ad10bd0410 for the v3.x branch, both introduce the same fix in the write_config function across different parts of the codebase.

The core of the vulnerability is that the write_config function, which is responsible for saving settings to the config.ini file, did not sanitize string values. An attacker could send specially crafted HTTP requests with CRLF characters in the parameters, which would then be written directly into the configuration file. This could allow the attacker to add or modify configuration settings, potentially disabling security features or altering the application's behavior.

The patch adds a sanitization step within the write_config function. It iterates through the configuration items and uses value.replace('\r', '').replace('\n', '').replace('\x00', '') on all string values to strip out CRLF and null characters before writing to the file. The presence of this fix in comfyui_manager/glob/manager_core.py, comfyui_manager/legacy/manager_core.py, and the older glob/manager_core.py clearly identifies write_config as the vulnerable function that would be invoked during exploitation.

Vulnerable functions

comfyui_manager.glob.manager_core.write_config

comfyui_manager/glob/manager_core.py

The function `write_config` is responsible for writing configuration settings to a file. Before the patch, it did not sanitize the string values being written. This allowed an attacker to inject CRLF (Carriage Return and Line Feed) characters into the configuration file by manipulating HTTP query parameters, leading to the creation of arbitrary configuration entries.

comfyui_manager.legacy.manager_core.write_config

comfyui_manager/legacy/manager_core.py

This is the legacy version of the `write_config` function and suffers from the same CRLF injection vulnerability. It writes unsanitized string values to the configuration file, allowing an attacker to tamper with security settings or modify application behavior by injecting malicious characters.

glob.manager_core.write_config

glob/manager_core.py

This function, found in an older branch (v3.x), is also responsible for writing to the configuration file. It was vulnerable to CRLF injection because it failed to sanitize string values before persisting them, allowing for the injection of arbitrary configuration data.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.