[PR #2221] [MERGED] Add Dehypnotic Save nodes to custom-node-list.json #2363

New issue

Closed

opened 2026-10-28 21:09:15 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-28 21:09:15 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/ComfyUI-Manager/pull/2221
Author: @Dehypnotic
Created: 10/14/2025
Status: ✅ Merged
Merged: 10/26/2025
Merged by: @ltdrdata

Base: main ← Head: main

📝 Commits (1)

3d2e78d Add Dehypnotic Save nodes to custom-node-list.json

📊 Changes

1 file changed (+10 additions, -0 deletions)

View changed files

📝 custom-node-list.json (+10 -0)

📄 Description

I requested name, folders and description changed about a week ago after adding two nodes to the existing one. It was merged to main but soon after removed and placed in the legacy-channel tagged as removed. The old record was placed in dev tagged as unsafe with the explanation: "This nodepack contains a node that has a vulnerability allowing write to arbitrary file paths.".

I have now retested them all and none of them write to arbitrary file paths without having them in the offline whitelist that I was told to create the first time I submitted the Save MP3-node. Isn't this considered safe anymore?

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/ComfyUI-Manager/pull/2221 **Author:** [@Dehypnotic](https://github.com/Dehypnotic) **Created:** 10/14/2025 **Status:** ✅ Merged **Merged:** 10/26/2025 **Merged by:** [@ltdrdata](https://github.com/ltdrdata) **Base:** `main` ← **Head:** `main` --- ### 📝 Commits (1) - [`3d2e78d`](https://github.com/Comfy-Org/ComfyUI-Manager/commit/3d2e78dd93f46de0d365612ac964fe5daf454d54) Add Dehypnotic Save nodes to custom-node-list.json ### 📊 Changes **1 file changed** (+10 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `custom-node-list.json` (+10 -0) </details> ### 📄 Description I requested name, folders and description changed about a week ago after adding two nodes to the existing one. It was merged to main but soon after removed and placed in the legacy-channel tagged as removed. The old record was placed in dev tagged as unsafe with the explanation: "This nodepack contains a node that has a vulnerability allowing write to arbitrary file paths.". I have now retested them all and none of them write to arbitrary file paths without having them in the offline whitelist that I was told to create the first time I submitted the Save MP3-node. Isn't this considered safe anymore? --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-28 21:09:15 +00:00