Critical · published December 13, 2024
🚨 Code injection is lurking in ComfyUI-Ace-Nodes, and it’s as easy as pie! 🍰 Just toss user data into the ACE_ExpressionEval node and watch arbitrary code execute on the server! Think of it like a restaurant where the chef blindly follows any order without checking the ingredients — if a customer orders something dangerous, it goes straight to the plate! An attacker could infiltrate the system and execute any code they want, potentially accessing sensitive data or taking over the entire server. This level of vulnerability is absolutely devastating and could lead to catastrophic consequences for any affected organization.
Think of it like a restaurant where the chef blindly follows any order without checking the ingredients — if a customer orders something dangerous, it goes straight to the plate! The vulnerability stems from the ACE_ExpressionEval node's use of eval() in its entrypoint function, which allows user-controlled data to run arbitrary code on the server without proper validation.
An attacker could infiltrate the system and execute any code they want, potentially accessing sensitive data or taking over the entire server. This level of vulnerability is absolutely devastating and could lead to catastrophic consequences for any affected organization. Immediately update to the latest version of ComfyUI-Ace-Nodes where this issue has been patched. Review and audit the code to eliminate any other risky eval() usages, and ensure strict input validation across workflows. You've got this! By taking these steps, you'll help keep your server safe and secure. 🛡️