CVE-2024-21574 | ltdrdata ComfyUI-Manager up to 2.51.0 POST Request /customnode/install pip code injection

A vulnerability, which was classified as very critical, was found in ltdrdata ComfyUI-Manager up to 2.51.0. This affects an unknown part of the file /customnode/install of the component POST Request Handler. The manipulation of the argument pip leads to code injection.

This vulnerability is uniquely identified as CVE-2024-21574. It is possible to initiate the attack remotely. There is no exploit available.

It is recommended to upgrade the affected component.