CVE-2024-21574
Critical
Description
The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or URL, resulting in remote code execution (RCE) on the server.
SeverityCritical
CVSS10.0
Exploit probability—
ProductComfyUI-Manager
PublishedDec 12, 2024
First seenDec 12, 2024
Weakness typeCWE-94Code injection
How to fix
Update
- ltdrdata ComfyUI-Manager2.51.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ltdrdata ComfyUI-Manager | v < 2.51.1 | 2.51.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.