← fix library

CRITICAL ComfyUI-Manager: ComfyUI-Manager CVE-2025-67303 — unauthenticated RCE

Why it matters

Your ComfyUI-Manager extension is older than 3.38. Its configuration endpoints are reachable without a password; an attacker can flip the security level to weak and install a malicious custom node — that is remote code execution on your GPU box.

Fix it — 2 steps

1. Upgrade ComfyUI-Manager to 3.38 or later (its config data moves to a protected directory with the new 'system user protection API').
2. Until upgraded, keep ComfyUI off the public IP entirely (see the 'ComfyUI open to the internet' card) — this bug needs network reachability.

Verify it’s fixed

curl -m 5 http://127.0.0.1:8188/api/manager/version  # manager version must be >= 3.38

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-67303
• https://github.com/Comfy-Org/ComfyUI-Manager/blob/main/docs/en/v3.38-userdata-security-migration.md