CVE-2024-21574
The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes whi...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or URL, resulting in remote code execution (RCE) on the server.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com