CVE-2024-21574: ComfyUI-Manager arbitrary pip package installation
CVE-2024-21574 was a vulnerability in ComfyUI-Manager that allowed arbitrary pip package installation without validation. A security fix added checks to block pip packages not present in the official allowlist.
What happened
CVE-2024-21574 affected ComfyUI-Manager, a system for managing custom nodes. The vulnerability allowed installation of arbitrary pip packages that were not in the allowlisted custom-node-list.json files.
Index analysis
A fix was committed that added validation to check pip packages against a list of approved packages. The system now returns a 'block' security level for any pip packages not found in the allowlisted data, and blocks their installation.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.