[GH-ISSUE #2632] Possible security issue with how the manager handles Node Version Statuses & security scans. #1010

New issue

Open

opened 2026-10-27 21:24:59 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-27 21:24:59 +00:00

Owner

Originally created by @JasonHoku on GitHub (Feb 20, 2026).
Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/2632

During my research of this issue I also found that people were still able to download my flagged custom node if they used the latest or nightly versions. Also if the security scan hadn't finished and it was still marked as NodeVersionStatusPending the version WOULD show up in ComfyUI Manager, it would only disappear after the security scan finished and marked it as flagged. It seems like it sort of defeats the purpose of using NodeVersionStatusActive and the security scans if people can still download them through the manager. Perhaps a shield icon 🛡 next to versions that have been scanned and passed or approved could inform people of this?

Pic with 1.12.2 is while the status was pending, pic without is AFTER the security scan when the version gets flagged as
NodeVersionStatusFlagged and needing review.

So if the security scan hasn't finished people could be downloading malicious code and thinking it's been reviewed or scanned or is safe.

Originally created by @JasonHoku on GitHub (Feb 20, 2026). Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/2632 During my research of this issue I also found that **people were still able to download my flagged custom node if they used the latest or nightly versions**. Also **if the security scan hadn't finished and it was still marked as NodeVersionStatusPending the version WOULD show up in ComfyUI Manager**, it would only disappear after the security scan finished and marked it as flagged. It seems like it sort of defeats the purpose of using `NodeVersionStatusActive` and the security scans if people can still download them through the manager. Perhaps a shield icon 🛡 next to versions that have been scanned and passed or approved could inform people of this? <img width="323" height="132" alt="Image" src="https://github.com/user-attachments/assets/3f9eef05-c57c-4df8-b779-142949a29814" /> Pic with 1.12.2 is while the status was pending, pic without is AFTER the security scan when the version gets flagged as NodeVersionStatusFlagged and needing review. <img width="314" height="123" alt="Image" src="https://github.com/user-attachments/assets/3539898e-2080-4c51-9eae-2ee0cf79edc0" /> So if the security scan hasn't finished people could be downloading malicious code and thinking it's been reviewed or scanned or is safe.

bsakaguchi referenced this issue

2026-10-27 21:33:26 +00:00

[PR #1010] [MERGED] Update custom-node-list.json with ComfyUI-Img2DrawingAssistants #1649