Summary
Installing a registry-listed node through ComfyUI-Manager can pull in additional custom nodes that are not in the registry, never shown to the user, and not tracked by Manager. One node installed this way (ComfyUI-Env-Manager) contains an unauthenticated command-execution route (see PozzettiAndrea/ComfyUI-Env-Manager#5). This report is about the install path that puts unlisted code on the machine without the user choosing it, not the RCE itself.
How it happens
- ComfyUI-SAM3, ComfyUI-SAM3DBody, ComfyUI-Sharp and ComfyUI-GeometryPack (same author) are listed in the Manager registry.
- Each ships a
comfy-env-root.toml with a [node_reqs] section naming other GitHub repos as dependencies.
- The
comfy-env package (currently 0.3.89), which these nodes depend on, git clones every [node_reqs] entry straight into custom_nodes/ at install/update time (comfy_env/packages/node_dependencies.py, install_node_dependencies / clone_node).
- ComfyUI-Env-Manager is one of those
[node_reqs] entries and is not listed in the Manager registry. Checked the cached custom-node-list.json: zero matches for it, while the parent nodes are all present.
So a user installs a vetted, registry-listed node, and comfy-env side-loads an unvetted, unlisted node behind the registry's back. The same mechanism also pulled ComfyUI-DepthAnythingV3 and ComfyUI-Multiband onto my machine. I never saw or approved ComfyUI-Env-Manager.
Why this matters for the registry model
Registry review and Manager's security-level controls only cover what's listed. A listed node that runs git clone on arbitrary repos during install routes around all of it. The cloned code isn't pinned to a reviewed version, isn't shown in the install dialog, and updates independently of anything Manager knows about.
Suggestions
- Flag or reject registry nodes whose install/prestartup path
git clones other repos into custom_nodes/. At minimum surface it in the install dialog.
- If comfy-env-style dependency pulling is to be supported, require those dependencies to be registry entries that go through the same review and appear in the install list, rather than raw GitHub URLs cloned silently.
- Note that comfy-env re-clones a missing dependency, so disabling or removing a side-loaded node doesn't stick unless the parent is also stopped.
Reproduce
Install ComfyUI-SAM3 (or -Sharp) through Manager on a machine with comfy-env, then look at custom_nodes/ for ComfyUI-Env-Manager, ComfyUI-Multiband, etc. that were never selected.
Related: PozzettiAndrea/comfy-env#9 raises the opt-in/deployment side of comfy-env, but not the registry bypass or the fact that a side-loaded node carries an RCE.
Summary
Installing a registry-listed node through ComfyUI-Manager can pull in additional custom nodes that are not in the registry, never shown to the user, and not tracked by Manager. One node installed this way (ComfyUI-Env-Manager) contains an unauthenticated command-execution route (see PozzettiAndrea/ComfyUI-Env-Manager#5). This report is about the install path that puts unlisted code on the machine without the user choosing it, not the RCE itself.
How it happens
comfy-env-root.tomlwith a[node_reqs]section naming other GitHub repos as dependencies.comfy-envpackage (currently 0.3.89), which these nodes depend on,git clones every[node_reqs]entry straight intocustom_nodes/at install/update time (comfy_env/packages/node_dependencies.py,install_node_dependencies/clone_node).[node_reqs]entries and is not listed in the Manager registry. Checked the cachedcustom-node-list.json: zero matches for it, while the parent nodes are all present.So a user installs a vetted, registry-listed node, and comfy-env side-loads an unvetted, unlisted node behind the registry's back. The same mechanism also pulled ComfyUI-DepthAnythingV3 and ComfyUI-Multiband onto my machine. I never saw or approved ComfyUI-Env-Manager.
Why this matters for the registry model
Registry review and Manager's security-level controls only cover what's listed. A listed node that runs
git cloneon arbitrary repos during install routes around all of it. The cloned code isn't pinned to a reviewed version, isn't shown in the install dialog, and updates independently of anything Manager knows about.Suggestions
git clones other repos intocustom_nodes/. At minimum surface it in the install dialog.Reproduce
Install ComfyUI-SAM3 (or -Sharp) through Manager on a machine with comfy-env, then look at
custom_nodes/for ComfyUI-Env-Manager, ComfyUI-Multiband, etc. that were never selected.Related: PozzettiAndrea/comfy-env#9 raises the opt-in/deployment side of comfy-env, but not the registry bypass or the fact that a side-loaded node carries an RCE.