GHSA-562r-8445-54r2 ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler

• PyPI comfy-cli: >= 4.0.0, < 4.0.5 → fixed in 4.0.5 • PyPI comfy-cli: < 3.39.2 → fixed in 3.39.2

Impact Vulnerability Type: CRLF Injection via ConfigParser An attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the `config.ini` file. This can lead to security setting tampering or modification of application behavior. Affected Users: Users running ComfyUI-Manager in environments where ComfyUI is configured with the `--listen` option to allow remote access. CVSS Score: 7.5 (High) Patches Fixed in the following versions: • 3.39.2 (v3.x branch) • 4.0.5 (v4.x branch) Sanitization logic was added to the `write_config()` function to remove CRLF and NULL characters from all string values. Workarounds If upgrading is not possible: • Run ComfyUI-Manager only on trusted networks • Block external access via firewall • Run on localhost only without the `--listen` option References • CWE-93: Improper Neutralization of CRLF Sequences • OWASP CRLF Injection Credit This vulnerability was reported by: • 李存义 • D0n9 Li • Swings • Osword from SGLAB of Legendsec at Qi'anxin Group