CVE-2026-108962

6.3Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Limited impact
Weakness: CWE-74, CWE-94

Impact

Remote attackers can execute arbitrary code by tricking a user into loading a malicious model configuration. The attack requires user interaction to process the malicious config input.

Root cause

The SLConfig._file2dict function in local_groundingdino/util/slconfig.py unsafely processes the config argument, leading to code injection during GroundingDINO model loading.

Affected systems

storyicon comfyui_segment_anything commit ab6395596399d5048639cdab7e44ec9fae857a93 and earlier.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Fix & remediation

No official patched release exists yet. Disable the comfyui_segment_anything custom node or restrict ComfyUI workflows to trusted local configs only.

shell

$ git -C custom_nodes/comfyui_segment_anything rev-parse HEAD

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A vulnerability has been found in storyicon comfyui_segment_anything up to ab6395596399d5048639cdab7e44ec9fae857a93. Affected by this issue is the function SLConfig._file2dict of the file local_groundingdino/util/slconfig.py of the component GroundingDINO Model Loading. Such manipulation of the argument config leads to code injection. It is possible to launch the attack remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-108962