ComfyUI-Manager is an extension designed to enhance the usability of ComfyUI. Prior to versions 3.39.2 and 4.0.5, an attacker can inject special characters into…

CVE-2026-22777 affects ComfyUI-Manager, an extension for ComfyUI. Prior to versions 3.39.2 and 4.0.5, attackers could inject special characters into HTTP query parameters to add arbitrary configuration values to the config.ini file. This vulnerability allows for security setting tampering and modification of application behavior. The issue has been patched in versions 3.39.2 and 4.0.5.