Unauthenticated Path Traversal in ComfyUI-Easy-Use Exposes AI Workflows to Remote Code Execution

A critical vulnerability, CVE-2026-123790, has been identified in ComfyUI-Easy-Use version 1.3.6. The flaw is an unauthenticated path traversal vulnerability within the `save_preview()` handler for POST `/easyuse/save/{name}`. This allows an attacker to manipulate file paths, specifically enabling them to overwrite an installed custom node's Python entry point with an uploaded file. This vulnerability is particularly significant for cloud and DevOps practitioners working with AI/ML pipelines. The ability for an unauthenticated attacker to achieve remote code execution (RCE) by simply reaching the ComfyUI server is a severe threat. In a development or production environment, this could lead to compromise of sensitive intellectual property, data exfiltration, or even the deployment of malicious AI models. The fact that the attacker's code runs with the privileges of the ComfyUI process further escalates the potential impact, allowing for deep system compromise. This incident fits into a broader trend of increasing attacks targeting the software supply chain and development environments, especially as AI adoption accelerates. The complexity of AI frameworks and the reliance on numerous open-source components introduce new attack surfaces. As highlighted by recent reports, AI is exposing decades of software shortcuts, making systems more fragile and susceptible to exploitation. The use of AI in cyberattacks is also becoming more sophisticated, enabling both elite and amateur hackers to find and exploit vulnerabilities more easily. This particular vulnerability underscores the need for robust security practices not just in deployed applications, but throughout the entire AI development lifecycle, from code creation to deployment. In practice, organizations utilizing ComfyUI-Easy-Use should immediately update to a patched version or apply any available mitigations. Beyond patching, practitioners must implement stringent access controls for AI development environments, including multi-factor authentication and network segmentation. Regular security audits and penetration testing of AI platforms and their underlying infrastructure are crucial. Furthermore, developers should exercise extreme caution when integrating third-party custom nodes or components, thoroughly vetting them for potential vulnerabilities. The trade-off between rapid AI development and robust security is becoming increasingly apparent, and prioritizing security from the outset is no longer optional.