[PR #2918] [CLOSED] Fix: Addressed issues for ComfyUI-ACES-EXR-Toolkit #2878

New issue

Closed

opened 2026-10-28 21:13:22 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-28 21:13:22 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/ComfyUI-Manager/pull/2918
Author: @azhagurajpandians
Created: 5/26/2026
Status: ❌ Closed

Base: main ← Head: main

📝 Commits (1)

6fc93fd Add ComfyUI ACES EXR Toolkit to custom-node-list

📊 Changes

1 file changed (+11 additions, -0 deletions)

View changed files

📝 custom-node-list.json (+11 -0)

📄 Description

This PR replaces my previous closed PR. I have completely addressed the security issues flagged by the scanner in ComfyUI-ACES-EXR-Toolkit.

Security Fixes Implemented:

Removed imageio and imageio[freeimage] from dependencies to prevent any dynamic/unverified C-binary downloads.
Removed custom API endpoint /aces-exr/listdir and js/exr_browser.js which were flagged for arbitrary directory browsing/traversal.
Secured /nodex_hdr/view endpoint by strictly using os.path.basename() to restrict access only to the temporary directory.
Removed all usage of ctypes.
Completely transitioned to using ComfyUI's native OpenCV dependency (cv2) for EXR float32 support.

The node is now secure and fully compliant with the registry's safety guidelines. Let me know if there is anything else I need to address!

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/ComfyUI-Manager/pull/2918 **Author:** [@azhagurajpandians](https://github.com/azhagurajpandians) **Created:** 5/26/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `main` --- ### 📝 Commits (1) - [`6fc93fd`](https://github.com/Comfy-Org/ComfyUI-Manager/commit/6fc93fd142bc8bd24e8f5e4d7d863b134b886cbb) Add ComfyUI ACES EXR Toolkit to custom-node-list ### 📊 Changes **1 file changed** (+11 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `custom-node-list.json` (+11 -0) </details> ### 📄 Description This PR replaces my previous closed PR. I have completely addressed the security issues flagged by the scanner in `ComfyUI-ACES-EXR-Toolkit`. **Security Fixes Implemented:** - Removed `imageio` and `imageio[freeimage]` from dependencies to prevent any dynamic/unverified C-binary downloads. - Removed custom API endpoint `/aces-exr/listdir` and `js/exr_browser.js` which were flagged for arbitrary directory browsing/traversal. - Secured `/nodex_hdr/view` endpoint by strictly using `os.path.basename()` to restrict access only to the temporary directory. - Removed all usage of `ctypes`. - Completely transitioned to using ComfyUI's native OpenCV dependency (`cv2`) for EXR float32 support. The node is now secure and fully compliant with the registry's safety guidelines. Let me know if there is anything else I need to address! --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-28 21:13:22 +00:00