ComfyUI-Bmad-Nodes is vulnerable to Code Injection.
Date: 2024-12
Attack vector: rce
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2024-21576
CWE: CWE-94
CVSS: 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

ComfyUI-Bmad-Nodes is vulnerable to Code Injection. The issue stems from a validation bypass in the BuildColorRangeHSVAdvanced, FilterContour and FindContour custom nodes. In the entrypoint function to each node, there’s a call to eval which can be triggered by generating a workflow that injects a crafted string into the node. This can result in executing arbitrary code on the server.


Mitigations:

Architectural layers (MAESTRO):