CVE-2024-21576: Code Injection
ComfyUI-Bmad-Nodes is vulnerable to Code Injection. The issue stems from a validation bypass in the BuildColorRangeHSVAdvanced, FilterContour and FindContour custom nodes. In the entrypoint function to each node, there’s a call to eval which can be triggered by generating a workflow that injects a crafted string into the node. This can result in executing arbitrary code on the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21576?
CVE-2024-21576 is classified as a high severity vulnerability due to its potential for code injection.
How do I fix CVE-2024-21576?
To mitigate CVE-2024-21576, ensure input validation is properly implemented to prevent bypassing security measures.
What software does CVE-2024-21576 affect?
CVE-2024-21576 affects the ComfyUI Bmad Nodes software.
What causes CVE-2024-21576?
CVE-2024-21576 is caused by a validation bypass in custom nodes that allows for code injection through the eval function.
Can CVE-2024-21576 be exploited remotely?
Yes, CVE-2024-21576 can potentially be exploited remotely if an attacker can control the input to the vulnerable nodes.