catalog / Vision & Image / ComfyUI

⌬WorkflowVision & ImageFree

ComfyUI

Name: ComfyUI
Availability: InStock
Author: ai-supply

Modular node-graph GUI, API, and backend for diffusion-model image/media generation pipelines.

@ai-supply

安装量35k

⟳ upstream v0.33.1 · updated 7d ago

↗ 源代码仓库

← More Vision & Image Vision & Image leaderboard →How we grade security →Source ↗

! Grade B · 75/100 · ReviewSecurity assessment

✓No compromise signals18capabilities surfaced1known CVE5of 20 OWASP controls clear

External endpoints declaredExternal endpoints declaredExternal endpoints declaredExternal endpoints declared

scanned 5d agoosv · gitleaks · opengrep · picklescan + heuristicsfull breakdown in the Security tab ↓

ComfyUI

ComfyUI is a powerful, modular GUI, API, and backend for diffusion models, built around a graph/node interface where you wire up generation pipelines visually.

Users compose reusable workflows for image (and video/audio) generation, ControlNet, upscaling, LoRA, and custom nodes — giving fine-grained control without writing code, while remaining fully scriptable via its API.

GPL-3.0 licensed; the de-facto workflow engine for advanced Stable Diffusion and generative-media pipelines.

! Security: Review · 7575/100 · grade Bscanned 5d ago

✓ no compromise signals19 risk-surface · 10/20 OWASP controls flagged

Compromise signals — malicious or tampered code (leaked secrets, backdoors, a dropped executable) — reduce the score, and known dependency CVEs carry a bounded penalty (they warrant review but never QUARANTINE — update the dependency to clear). Other dangerous-by-capability traits are risk surface, expected for some capabilities. Every finding is mapped to its OWASP control below.

What this capability can do · med confidence (static)

⚑ filesystem⚑ shell⚑ network⚑ secrets

egress → coderabbit.ai, docs.comfy.org, app.element.io, discord.gg, ci.comfy.org, api.github.com, download.pytorch.org, www.python.org +20

96 steps⚑ uses secretscoderabbit.aidocs.comfy.orggithub.comapp.element.iodiscord.ggactions/github-script@v7actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

Findings mapped to the OWASP Top 10 for LLM Applications (2025) and the OWASP Machine Learning Security Top 10. Expand any flagged control for the exact findings — compromise reduces the score; expected/risk-surface do not, except a known CVE, which carries a small bounded penalty (high/critical → Review).

OWASP Top 10 for LLM Applications

⚠LLM03Supply Chaincritical

Vulnerable/compromised dependencies, models or archives in the artifact.

•Dependency manifest — 1 pip requirements declared · Comfy-Org-ComfyUI-aaabf34/manager_requirements.txtrisk surface

•Dependency manifest — 35 pip requirements declared · Comfy-Org-ComfyUI-aaabf34/requirements.txtrisk surface

•Dependency manifest — 4 pip requirements declared · Comfy-Org-ComfyUI-aaabf34/tests-unit/requirements.txtrisk surface

•Vulnerable dependencies — 159 known vulnerabilities in: gitpython@3.1.9, idna@3.9.0, pyjwt@2.9.0, uv@0.9.9, aiohttp@3.11.8, pydantic@2.0, simpleeval@1.0.0, transformers@4.50.3 (CWE-1395)known CVE · -25 pts

⚠LLM01Prompt Injectionhigh

Adversarial instructions embedded in an artifact that hijack a downstream LLM.

•Prompt-injection phrasing — instruction-subversion language detected · Comfy-Org-ComfyUI-aaabf34/SECURITY.md (CWE-77)risk surface

⚠LLM06Excessive Agencyhigh

Over-broad tool/permission surface or unrestricted egress.

•External endpoints declared — 1 distinct host(s) · Comfy-Org-ComfyUI-aaabf34/.ci/windows_amd_base_files/README_VERY_IMPORTANT.txtrisk surface

•External endpoints declared — 3 distinct host(s) · Comfy-Org-ComfyUI-aaabf34/.github/ISSUE_TEMPLATE/config.ymlrisk surface

•External endpoints declared — 2 distinct host(s) · Comfy-Org-ComfyUI-aaabf34/.github/ISSUE_TEMPLATE/feature-request.ymlrisk surface

•External endpoints declared — 4 distinct host(s) · Comfy-Org-ComfyUI-aaabf34/.github/workflows/windows_release_nightly_pytorch.ymlrisk surface

•External endpoints declared — 20 distinct host(s) · Comfy-Org-ComfyUI-aaabf34/README.mdrisk surface

•Broad capability surface — 4 high-impact capability categories referenced — verify least-privilege · Comfy-Org-ComfyUI-aaabf34/comfy/text_encoders/hydit_clip_tokenizer/vocab.txt (CWE-272)risk surface

•Broad capability surface — 3 high-impact capability categories referenced — verify least-privilege · Comfy-Org-ComfyUI-aaabf34/comfy_api_nodes/nodes_gemini.py (CWE-272)risk surface

•Egress to a private/loopback host — 127.0.0.1 · Comfy-Org-ComfyUI-aaabf34/script_examples/basic_api_example.py (CWE-918)risk surface

•External endpoints declared — 9 distinct host(s) · Comfy-Org-ComfyUI-aaabf34/tests-unit/feature_flags_test.pyrisk surface

⚠LLM05Improper Output Handlingmedium

Code that pipes model/user output into shell, eval, SQL or paths unsafely.

•Suspicious code patterns — dynamic code execution · Comfy-Org-ComfyUI-aaabf34/comfy/audio_encoders/audio_encoders.py (CWE-95)risk surface

•Suspicious code patterns — OS command execution · Comfy-Org-ComfyUI-aaabf34/cuda_malloc.py (CWE-78)risk surface

⚠LLM10Unbounded Consumptionmedium

Unbounded loops/recursion causing DoS or runaway cost.

Enforced at runtime by the gateway (rate limits + spend caps + size caps); static check flags unbounded loops.

•Potentially unbounded loop — an infinite loop (while True / while(1) / for(;;)) may cause runaway consumption · Comfy-Org-ComfyUI-aaabf34/app/assets/api/routes.py (CWE-835)risk surface

⚠LLM02Sensitive Information Disclosurelow

Secrets, credentials or PII shipped inside the artifact.

•Low-confidence secret match — 1 possible: generic-api-key · Comfy-Org-ComfyUI-aaabf34/comfy/text_encoders/flux.py (CWE-798)risk surface

⚠LLM07System Prompt Leakagelow

Secrets, internal hosts or proprietary logic exposed in shipped prompts.

•Low-confidence secret match — 1 possible: generic-api-key · Comfy-Org-ComfyUI-aaabf34/comfy/text_encoders/flux.py (CWE-798)risk surface

§LLM09MisinformationGovernance

Artifacts designed to produce false/deceptive output.

Detectable only by runtime behavioral evaluation; addressed via responsible-use attestation.

✓LLM04Data and Model PoisoningPassed

Backdoors/poisoning in training data or serialized models.

Behavioral poisoning needs model execution; static check covers unsafe serialization + dataset skew only.

✓LLM08Vector and Embedding WeaknessesPassed

PII or plaintext source leakage in embedding/vector exports.

Embedding inversion/poisoning is largely runtime; static check covers PII in vector exports.

OWASP Machine Learning Security Top 10

⚠ML06AI Supply Chaincritical

Compromised PyPI/npm packages, typosquats, unsafe serialized models.

•Dependency manifest — 1 pip requirements declared · Comfy-Org-ComfyUI-aaabf34/manager_requirements.txtrisk surface

•Dependency manifest — 35 pip requirements declared · Comfy-Org-ComfyUI-aaabf34/requirements.txtrisk surface

•Dependency manifest — 4 pip requirements declared · Comfy-Org-ComfyUI-aaabf34/tests-unit/requirements.txtrisk surface

⚠ML02Data Poisoninghigh

Poisoned training datasets with triggers or anomalous distributions.

Static check covers trigger phrasing, PII and label skew; full poisoning detection is runtime.

•Prompt-injection phrasing — instruction-subversion language detected · Comfy-Org-ComfyUI-aaabf34/SECURITY.md (CWE-77)risk surface

⚠ML09Output Integritymedium

Middleware tampering with model outputs in transit.

Gateway enforces TLS + response integrity; static check flags output-rewriting code.

•Suspicious code patterns — dynamic code execution · Comfy-Org-ComfyUI-aaabf34/comfy/audio_encoders/audio_encoders.py (CWE-95)risk surface

•Suspicious code patterns — OS command execution · Comfy-Org-ComfyUI-aaabf34/cuda_malloc.py (CWE-78)risk surface

§ML01Input Manipulation (Adversarial)Governance

Models vulnerable to adversarial perturbations.

Requires runtime robustness evaluation; addressed via publisher robustness attestation.

§ML03Model InversionGovernance

Training data reconstructable from a model's outputs.

Runtime/evaluation property; addressed via model-card data-provenance + DP attestation.

§ML04Membership InferenceGovernance

Determining whether a record was in the training set.

Runtime/evaluation property; addressed via overfitting disclosure + DP attestation.

§ML08Model SkewingGovernance

Models trained on skewed data producing biased output.

Requires fairness evaluation; addressed via model-card bias/limitations disclosure.

✓ML05Model TheftPassed

Unlicensed re-distribution / license-incompatible derivatives.

Static check verifies license declaration; extraction throttling is runtime.

✓ML07Transfer Learning AttackPassed

Backdoored base models / LoRA adapters propagating to derivatives.

Backdoor detection needs behavioral probing; static check covers unsafe serialization + provenance.

✓ML10Model Poisoning (Weights)Passed

Tampered model weight files; integrity must be verifiable.

Static check enforces safe formats + records a content hash for downstream verification.

Other findings (13) · hygiene / uncategorized

•Disallowed file type — '.bat' executables are not permitted · Comfy-Org-ComfyUI-aaabf34/.ci/update_windows/update_comfyui.bat (CWE-434)risk surface

•Unrecognized file type — '.gitattributes' is not on the allowlist · Comfy-Org-ComfyUI-aaabf34/.gitattributesrisk surface

•Unrecognized file type — '.gitignore' is not on the allowlist · Comfy-Org-ComfyUI-aaabf34/.gitignorerisk surface

•Unrecognized file type — '.?' is not on the allowlist · Comfy-Org-ComfyUI-aaabf34/CODEOWNERSrisk surface

•Unrecognized file type — '.ini' is not on the allowlist · Comfy-Org-ComfyUI-aaabf34/alembic.inirisk surface

•Unrecognized file type — '.mako' is not on the allowlist · Comfy-Org-ComfyUI-aaabf34/alembic_db/script.py.makorisk surface

•Unrecognized file type — '.frag' is not on the allowlist · Comfy-Org-ComfyUI-aaabf34/blueprints/.glsl/Brightness_and_Contrast_1.fragrisk surface

•Suspicious network references — suspicious TLD (3 URLs) · Comfy-Org-ComfyUI-aaabf34/blueprints/Text to Image (NetaYume Lumina).jsonrisk surface

•Unrecognized file type — '.pyi' is not on the allowlist · Comfy-Org-ComfyUI-aaabf34/comfy_api/latest/generated/ComfyAPISyncStub.pyirisk surface

•Unrecognized file type — '.example' is not on the allowlist · Comfy-Org-ComfyUI-aaabf34/custom_nodes/example_node.py.examplerisk surface

•Suspicious network references — raw IP URL (3 URLs) · Comfy-Org-ComfyUI-aaabf34/script_examples/basic_api_example.pyrisk surface

•Suspicious network references — suspicious TLD (2 URLs) · Comfy-Org-ComfyUI-aaabf34/tests-unit/app_test/frontend_manager_test.pyrisk surface

•Suspicious network references — raw IP URL (1 URLs) · Comfy-Org-ComfyUI-aaabf34/tests-unit/assets_test/conftest.pyrisk surface

✔ verified source · pinned Comfy-Org-ComfyUI-aaabf34

Check against a policy

The same gate an agent runs before installing (POST /api/v1/trust/comfyui/check). Click a policy:

Consume ComfyUI programmatically. Authenticate with an API key or session — see Authorize an agent.

# Agents: CHECK BEFORE YOU INSTALL (no auth) — score, grade, level, capability manifest
curl https://ai-supply.store/api/v1/trust/comfyui

# Gate against your org policy (returns { pass, violations })
curl -X POST https://ai-supply.store/api/v1/trust/comfyui/check \
  -H "Content-Type: application/json" \
  -d '{"minGrade":"B","denyPermissions":["shell"],"denyUnknownEgress":true}'

# CLI
npx ai-supply add comfyui

# REST (install → download)
curl -X POST https://ai-supply.store/api/v1/listings/comfyui/install \
  -H "Authorization: Bearer $AIM_KEY"

# MCP tool
install_listing({ "slug": "comfyui" })

OpenAPI spec →