Description (CNA)
The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or URL, resulting in remote code execution (RCE) on the server.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| ltdrdata / ComfyUI-Manager | affected 0 before 2.51.1 |
CWE
CWE-94
References
- https://github.com/ltdrdata/ComfyUI-Manager/commit/ffc095a3e5acc1c404773a0510e6d055a6a72b0e
- https://github.com/ltdrdata/ComfyUI-Manager/blob/ffc095a3e5acc1c404773a0510e6d055a6a72b0e/glob/manager_server.py#L798
ADP enrichment
No English description supplied.
No references supplied.