A flaw has been found in AIDC-AI ComfyUI-Copilot up to 2

CVE-2026-13493 lives in backend/controller/conversation_api.py of AIDC-AI ComfyUI-Copilot — a third-party custom node that bolts an LLM assistant onto the popular ComfyUI image-generation framework. The Workflow Checkpoint Restore Handler does improper control of resource identifiers (CWE-99): an authenticated request can manipulate a checkpoint/workflow identifier so the handler dereferences a resource the caller shouldn't reach. CVSS vector C:L/I:N/A:N confirms the impact ceiling: read-only, partial confidentiality, no integrity or availability hit. All versions 2.0.0 through 2.0.28 are affected; as of disclosure (2026-06-28) PR #150 sits unmerged, so no fixed release yet.

The vendor's LOW (3.1) rating matches reality. ComfyUI-Copilot is a hobbyist/creator-tier plugin layered on top of ComfyUI — itself rarely Internet-exposed and almost never deployed in regulated enterprise data paths. The attacker must already be an authenticated user of a Copilot instance, the attack complexity is high (AC:H), EPSS is 0.00232 (~bottom quartile), KEV is silent, and the worst outcome is leaking workflow metadata or adjacent file content — not RCE, not auth bypass, not lateral movement. There is no role-multiplier case where this component sits on a domain controller, hypervisor, or identity provider. Treat as a tracked backlog item, not an incident.

Why this verdict

• Authentication required (PR:L): The attacker must already hold a valid session on the Copilot backend, which by itself filters out the unauthenticated drive-by class.
• High attack complexity (AC:H): Vendor and CVSS both call exploitation difficult — non-trivial payload shape, possibly state-dependent.
• Impact capped at C:L / I:N / A:N: Best-case attacker outcome is reading workflow JSON or adjacent file content the Copilot process can already see. No RCE, no integrity, no DoS.
• Role multiplier: low-value role only. ComfyUI-Copilot runs in the (a) low-value-role bucket — creator workstation or isolated GenAI sandbox. There is no (c) high-value-role deployment pattern: it is not on DCs, identity providers, hypervisors, backup, CA, EDR, or supply-chain registries. Floor stays at LOW.
• Installed-base evidence: Shodan-visible ComfyUI footprint is a few thousand worldwide, and the Copilot custom node is an opt-in subset — well under 1% of enterprise estates have it at all, and effectively 0% of regulated/identity-tier hosts.
• EPSS 0.00232 + no KEV + no observed exploitation: All three exploit-prediction signals align with the LOW bucket.

Why not higher?

Upgrading to MEDIUM would require either a credible mass-exploitation signal (none — EPSS bottom-quartile, no KEV, no campaigns) or a role-multiplier story where the affected component lands on a high-value asset (impossible — Copilot is a creator-tier plugin). The impact ceiling itself (C:L/I:N/A:N) caps the realistic damage well below what MEDIUM implies.

Why not lower?

We didn't push to IGNORE because a public PoC exists, no patched version has shipped yet (PR #150 unmerged), and the vulnerability is reachable over the network by any low-privileged user — so a multi-tenant Copilot deployment with sloppy auth scoping could genuinely leak another tenant's workflow. That keeps it in the tracked-backlog bucket, not the document-and-forget bucket.

1. Inventory ComfyUI-Copilot installs — Grep your AI/ML asset register and developer workstation MDM data for ComfyUI custom-node directories containing ComfyUI-Copilot. Most orgs will return zero hits; the few that do are typically R&D or marketing creative teams. No mitigation SLA applies at LOW — handle within the noisgate remediation SLA of 365 days.
2. Block Copilot backend from untrusted networks — Bind the ComfyUI/Copilot HTTP listener to localhost or place it behind an authenticating reverse proxy with per-user scoping. This kills the network-reachability prerequisite entirely for any install that doesn't strictly need remote use.
3. Scope service account file access — Run ComfyUI/Copilot as an unprivileged user whose filesystem read scope is restricted to the model/workflow directory only. Caps the worst-case CWE-99 read to data the user already has rights to.
4. Track PR #150 and pin to the fixed release — Subscribe to AIDC-AI/ComfyUI-Copilot releases. When the fix merges and a 2.0.29+ release ships, upgrade in the same maintenance window you already use for creative-tools — no out-of-band action required.

Run on any host that may have ComfyUI-Copilot installed (developer workstation, GPU server, AI sandbox). Invoke as python check_cve_2026_13493.py /path/to/ComfyUI/custom_nodes — defaults to scanning the current directory if no path given. Needs only read access to the ComfyUI custom_nodes directory; no elevated privileges required.

#!/usr/bin/env python3
# check_cve_2026_13493.py
# Detects vulnerable installs of AIDC-AI/ComfyUI-Copilot (<= 2.0.28).
# Exit codes: 0=PATCHED/NotInstalled, 1=VULNERABLE, 2=UNKNOWN

import os, re, sys, json
from pathlib import Path

VULN_MAX = (2, 0, 28)   # inclusive: every version <= 2.0.28 is affected

def parse_version(v):
    m = re.match(r"(\d+)\.(\d+)\.(\d+)", v.strip().lstrip("vV"))
    return tuple(int(x) for x in m.groups()) if m else None

def find_copilot_roots(base):
    roots = []
    for p in Path(base).rglob("ComfyUI-Copilot"):
        if p.is_dir():
            roots.append(p)
    return roots

def extract_version(root):
    # Try common locations in order.
    candidates = [
        root / "pyproject.toml",
        root / "setup.py",
        root / "package.json",
        root / "__init__.py",
        root / "VERSION",
    ]
    for c in candidates:
        if not c.exists():
            continue
        try:
            text = c.read_text(errors="ignore")
        except Exception:
            continue
        if c.name == "package.json":
            try:
                v = json.loads(text).get("version")
                if v: return v
            except Exception:
                pass
        m = re.search(r"version\s*=\s*[\"']([0-9]+\.[0-9]+\.[0-9]+)", text, re.I)
        if m: return m.group(1)
        m = re.search(r"__version__\s*=\s*[\"']([0-9]+\.[0-9]+\.[0-9]+)", text)
        if m: return m.group(1)
    return None

def main():
    base = sys.argv[1] if len(sys.argv) > 1 else "."
    if not Path(base).exists():
        print(f"UNKNOWN: path not found: {base}")
        return 2
    roots = find_copilot_roots(base)
    if not roots:
        print("PATCHED: ComfyUI-Copilot not installed under", base)
        return 0
    worst = 0
    for r in roots:
        v = extract_version(r)
        if not v:
            print(f"UNKNOWN: {r} — version not determinable")
            worst = max(worst, 2)
            continue
        parsed = parse_version(v)
        if parsed is None:
            print(f"UNKNOWN: {r} — version string {v!r} unparseable")
            worst = max(worst, 2)
            continue
        status = "VULNERABLE" if parsed <= VULN_MAX else "PATCHED"
        print(f"{status}: {r} (version {v})")
        if status == "VULNERABLE":
            worst = max(worst, 1)
    return worst

if __name__ == "__main__":
    sys.exit(main())

Sources

1. Vulnerability-Lookup: CVE-2026-13493
2. Vulnerability-Lookup: GHSA-CJXX-6MF8-HQMW
3. AIDC-AI/ComfyUI-Copilot GitHub repository
4. ComfyUI-Copilot issue #149 (disclosure)
5. ComfyUI-Copilot PR #150 (proposed fix)
6. ComfyUI-Copilot releases page
7. ComfyUI-Copilot project site
8. MITRE CWE-99: Improper Control of Resource Identifiers