Home » Database

AVID-2026-R1409

Description

Vulnerability CVE-2024-21574

Details

The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or URL, resulting in remote code execution (RCE) on the server.

Reason for inclusion in AVID: CVE-2024-21574 describes a server-side vulnerability in ComfyUI-Manager where an unauthenticated POST to /customnode/install can trigger pip install of a user-controlled package, leading to remote code execution. This directly concerns AI software tooling and extensions, is a software supply chain risk in AI pipelines (installing custom nodes/dependencies from untrusted sources), and is a security vulnerability with clear evidence in the CVE report.

References

Affected or Relevant Artifacts

  • Developer: ltdrdata
  • Deployer: ltdrdata
  • Artifact Details:
TypeName
SystemComfyUI-Manager

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Base Score10.0
Base Severity🔴 Critical
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionNONE
ScopeCHANGED
Confidentiality Impact🔴 High
Integrity Impact🔴 High
Availability Impact🔴 High

CWE

IDDescription
CWE-94Code Injection

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2024-12-12
  • Version: 0.3.3
  • AVID Entry