CVE-2024-21574

The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or...

PT-2024-18965

Name of the Vulnerable Software and Affected Versions SoftwareX affected versions not specified Description The issue arises from a lack of validation of the pip field in a POST request sent to the "/customnode/install" endpoint, which is used to install custom nodes and is added to the server by...

CVE-2024-21574: Improper Control of Generation of Code

The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or...