Remote Code Execution Vulnerability in Custom Node Installation Endpoint

CVE-2024-21574

Summary

A significant security issue exists in ComfyUI-Manager, where the lack of validation for the pip field in POST requests to the /customnode/install endpoint can be exploited. This vulnerability allows an attacker to create a malicious request that could result in unauthorized pip installations from user-controlled packages or URLs. Consequently, this behavior enables the potential for remote code execution on the server, posing a serious risk to the integrity and confidentiality of the server's environment.

References