CVE-2024-21577: Code Injection
ComfyUI-Ace-Nodes is vulnerable to Code Injection. The ACEExpressionEval node contains an eval() in its entrypoint function that accepts arbitrary user-controlled data. A user can create a workflow that results in executing arbitrary code on the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21577?
CVE-2024-21577 has a high severity due to its potential for code injection, allowing execution of arbitrary code.
How do I fix CVE-2024-21577?
To fix CVE-2024-21577, avoid using user-controlled data in the ACE_ExpressionEval node's eval() function.
What are the potential impacts of CVE-2024-21577?
The potential impacts of CVE-2024-21577 include unauthorized access to server resources and execution of malicious code.
Who is affected by CVE-2024-21577?
CVE-2024-21577 affects users of the ComfyUI-Ace-Nodes software that utilize the ACE_ExpressionEval node.
How was CVE-2024-21577 discovered?
CVE-2024-21577 was discovered through code review which revealed the insecure use of eval() with untrusted input.