Know what changed.
Trace why it matters.

ComfyUI-Easy-Use version 1.4.1 and earlier has a vulnerability in save_preview() that lets an unauthenticated attacker overwrite an installed custom node’s Python file. An attacker can upload a Python file to ComfyUI’s input directory and use save_preview() to replace a custom node’s __init__.py; ComfyUI imports and executes the modified node after restart.

Successful exploitation allows arbitrary Python code and operating-system commands with the privileges of the ComfyUI process.

Huntress said an intruder used access to cloud-hosted ScreenConnect panels to push commands to managed endpoints, installing attacker-controlled ScreenConnect copies on at least 288 computers across 48 organizations. Huntress said about one-third of the machines were reached within 10 minutes and all were reached within approximately 90 minutes.

Huntress said the extension bypassed ScreenConnect user accounts, roles, and MFA by authenticating with a shared access key instead.

The npm library promzard, versions 4.0.0 and earlier, is vulnerable to remote code execution because context-object keys are interpolated as unsanitized JavaScript source and evaluated. promzard evaluates a generated function-expression source string with vm.runInThisContext(), allowing attacker-controlled syntax in a context key to execute during evaluation.

An attacker who can influence ctx keys, including through a parsed configuration file, HTTP request, or environment variable, can break out of the function-parameter list and inject arbitrary JavaScript into the Node.js process.