ComfyUI-Ace-Nodes is vulnerable to Code Injection.
Date: 2024-12
Attack vector: rce
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2024-21577
CWE: CWE-94
CVSS: 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

ComfyUI-Ace-Nodes is vulnerable to Code Injection. The ACE_ExpressionEval node contains an eval() in its entrypoint function that accepts arbitrary user-controlled data. A user can create a workflow that results in executing arbitrary code on the server.


Mitigations:

Architectural layers (MAESTRO):