CVE-2026-22777

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-22777
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22777.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-22777
Aliases
Published
2026-01-10T06:43:21.579Z
Modified
2026-02-10T04:40:11.668464Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler
Details

ComfyUI-Manager is an extension designed to enhance the usability of ComfyUI. Prior to versions 3.39.2 and 4.0.5, an attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the config.ini file. This can lead to security setting tampering or modification of application behavior. This issue has been patched in versions 3.39.2 and 4.0.5.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22777.json",
    "cwe_ids": [
        "CWE-93"
    ]
}
References

Affected packages

Git / github.com/comfy-org/comfyui-manager

Affected ranges

Type
GIT
Repo
https://github.com/comfy-org/comfyui-manager
Events
Introduced
3f0fc85b95b61f211c9f1922ae57230f15ada905
Fixed
f4fa394e0f03b013f1068c96cff168ad10bd0410

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22777.json"