Comfy-Org/ComfyUI: 4 advisories published 13 days ago, CVE-2026-56670 through -56673 still RESERVED and absent from the Advisory Database

Inizia verificando i quattro advisories di ComfyUI collegati tramite la GitHub Advisory Database API e le prove CVE fornite. Determina se lo stato di pubblicazione o i metadati pip dichiarati impediscono la curation e chiarisci il processo per la CVE-2026-56674 chiusa separatamente. Il lavoro è completato quando i quattro advisories sono rappresentati correttamente oppure il problema bloccante è documentato, con la spiegazione del processo per l’identificatore riservato.

Summary

Four repository security advisories on Comfy-Org/ComfyUI were published on 2026-07-15. Thirteen days later, none have been added to the GitHub Advisory Database, and all four assigned CVE IDs are still in RESERVED state on the CVE Program side.

This is being tracked by CISA (VINCE case VU#150407), who are waiting on published CVE records to issue a CSAF document and close the case, so I'd appreciate any nudge you can give these.

Affected advisories

GHSA	CVE	Summary	Published
GHSA-rj8c-c4p8-3c5h	CVE-2026-56670	Stored XSS via SVG file upload on the /view endpoint	2026-07-15T21:49:45Z
GHSA-pj59-g5vv-74q4	CVE-2026-56671	Path traversal in /experiment/models/preview	2026-07-15T21:49:46Z
GHSA-53g8-45wq-pcv8	CVE-2026-56672	Stored XSS via /userdata/{file}	2026-07-15T21:49:47Z
GHSA-rvxv-29p8-pxgq	CVE-2026-56673	Path traversal in LoadImage via the /prompt API	2026-07-15T21:49:48Z

All four are fixed in ComfyUI v0.28.0 (affected: < 0.28.0).

Evidence

Repository advisories are published and publicly reachable:

$ curl -so /dev/null -w '%{http_code}\n' https://github.com/Comfy-Org/ComfyUI/security/advisories/GHSA-rj8c-c4p8-3c5h
200

state: published, published_at set, closed_at and withdrawn_at both null on all four (via GET /repos/Comfy-Org/ComfyUI/security-advisories).

Not present in the global Advisory Database:

$ curl -s https://api.github.com/advisories/GHSA-rj8c-c4p8-3c5h
{"message":"Not Found", ...,"status":"404"}

Same 404 for the other three. No matching files in this repository.

CVE records still reserved:

$ curl -s https://cveawg.mitre.org/api/cve-id/CVE-2026-56670
{"cve_id":"CVE-2026-56670","cve_year":"2026","state":"RESERVED","owning_cna":"[REDACTED]"}

$ curl -s https://cveawg.mitre.org/api/cve/CVE-2026-56670
{"error":"CVE_RECORD_DNE","message":"The cve record for the cve id does not exist."}

Identical results for CVE-2026-56671, -56672, and -56673.

Possible complication worth flagging

The advisories declare the affected package as ecosystem pip, name ComfyUI, range < 0.28.0, patched 0.28.0. ComfyUI core is not distributed on PyPI — it is installed from source or via the desktop installer. The only PyPI project by that name is an unrelated third-party placeholder at version 0.0.1, so the declared version range does not map to a real registry artifact.

If that blocks curation, I'm happy to edit all four to a more appropriate representation (Other ecosystem pointing at the repository, or whatever you'd prefer) — just let me know which form you want and I'll update them. I'd rather fix the metadata than have these sit in a queue on a technicality.

I do see the note in #8734 about increased processing times from vulnerability volume, and the related blog post — so this may simply be queue depth. Flagging it anyway since there's an external coordinator waiting on the outcome.

Related

Same class of issue as #8831, #8786, and #8734.

One separate question

A fifth CVE, CVE-2026-56674 (GHSA-qg54-x235-567r), was assigned but the advisory was closed rather than published — on review we determined the issue was already mitigated by a pre-existing Sec-Fetch-Site check. That CVE ID is also still RESERVED.

What's the correct process to have that ID formally rejected so it doesn't remain a dangling reserved identifier? Closing the advisory clearly doesn't do it, and I'd like to return it cleanly rather than leave it hanging.

Thanks!