Skip to content
CVE PROGRAM SOURCE RECORD10.0 Critical

CVE-2024-21574

The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by t

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
snyk

Description

The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or URL, resulting in remote code execution (RCE) on the server.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ltdrdata ComfyUI-Manager

  • 0 to < 2.51.1affected

References