CyberPulse Cybersecurity News, with Source Links
FA
CERT/CC Vulnerability Notes

VU#944667: ComfyUI-Easy-Use contains unauthenticated path traversal vulnerability

Overview ComfyUI-Easy-Use version 1.3.6 contains a vulnerability in its save_preview() handler that allows an unauthenticated attacker to overwrite an installed custom node’s Python file. An attacker who can reach the affected ComfyUI instance over the network can use the overwrite to execute arbitrary code when ComfyUI restarts. Description ComfyUI is a node-based interface for building generative AI workflows. Comf…

Vulnerabilities & Zero-Day AI Security AI & Machine Learning Programming & Languages Operating Systems Identity & Access Security
Read the full article at CERT/CC Vulnerability Notes Removal request

This page shows only the headline and the short summary. The full text is published by the original source.

Related news

Full archive →
CERT/CC Vulnerability Notes

VU#685399: PromZard context key code injection leads to remote code execution

Overview The npm library promzard, versions 4.0.0 and earlier, is vulnerable to remote code execution due to direct string interpolation of context object keys, which allows unsanitized JavaScript code injection. Description promzard is a Node.js library designed to automate configuration workflows by evaluating template modules and generating data objects via interactive prompting. The library allows users to provid…

Vulnerabilities & Zero-Day Programming & Languages
Source