The vulnerability arises from the use of the GET method for the ComfyUI installation endpoint without requiring any form of authentication or client identification. This allows an attacker to craft a malicious webpage that, when visited by a victim, automatically triggers the installation of ComfyUI on the victim's device. If the device does not have sufficient capacity, this can lead to a crash, potentially disrupting the victim's operations.

An attacker creates a malicious webpage containing a form that sends a GET request to the ComfyUI installation endpoint. The attacker then tricks the victim into visiting this webpage. When the victim's browser loads the page, the form is automatically submitted, triggering the installation of ComfyUI on the victim's device without their knowledge. If the device lacks sufficient capacity, it may crash.

Users running the lollms-webui software version v9.9 who have not yet updated to the patched version are affected. This includes any deployment where the server is accessible and the ComfyUI installation endpoint is exposed.