CVE-2026-108962 Details
Description
A vulnerability has been found in storyicon comfyui_segment_anything up to ab6395596399d5048639cdab7e44ec9fae857a93. Affected by this issue is the function SLConfig._file2dict of the file local_groundingdino/util/slconfig.py of the component GroundingDINO Model Loading. Such manipulation of the argument config leads to code injection. It is possible to launch the attack remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
A code injection vulnerability has been identified in the Storyicon ComfyUI Segment Anything project, specifically in the GroundingDINO model loading component. The issue arises in the SLConfig._file2dict function within the local_groundingdino/util/slconfig.py file. This vulnerability allows for arbitrary code execution by manipulating the config argument when loading GroundingDINO models. The problem affects all platforms and can be exploited remotely by distributing a malicious model package through model-sharing channels.
It is recommended to stop importing Python files from the models directory. Instead, treat configuration files as data by loading known GroundingDINO configs from a non-executable format, or by shipping the config files with the plugin and not from user-writable model folders. If Python configs must be used, verify their integrity by checking the file's SHA-256 against the upstream config before import and failing on mismatch.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/storyicon/comfyui_segment_anything/issues/114 | CISA-ADP | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/storyicon/comfyui_segment_anything/ | [email protected] | Vendor |
| https://github.com/storyicon/comfyui_segment_anything/issues/114 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://vuldb.com/cve/CVE-2026-108962 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/998114 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/416781 | [email protected] | BundlePermission Required |
| https://vuldb.com/vuln/416781/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| storyicon comfyui_segment_anything | <= ab6395596399d5048639cdab7e44ec9fae857a93 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |