Comfy-Org/ComfyUI-embedded-workflow-editor
1
0
Fork 0
mirror of https://github.com/Comfy-Org/ComfyUI-embedded-workflow-editor.git synced 2026-11-04 23:47:24 +00:00
Code Issues 1 Projects Packages Wiki Activity

[PR #13] [MERGED] Fix React Server Components CVE vulnerabilities #13

New issue
Closed
opened 2026-10-26 22:00:53 +00:00 by bsakaguchi · 0 comments
bsakaguchi commented 2026-10-26 22:00:53 +00:00
Owner
Copy link

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/ComfyUI-embedded-workflow-editor/pull/13
Author: @vercel[bot]
Created: 2/1/2026
Status: ✅ Merged
Merged: 2/1/2026
Merged by: @snomiao

Base: main ← Head: vercel/react-server-components-cve-vu-6o8gxi

📝 Commits (4)

  • 601052f Fix React Server Components CVE vulnerabilities
  • 0ab7c69 format: Apply prettier --fix changes
  • 9d28088 fix: Add type assertions for sflow chains to resolve TypeScript errors
  • 4528056 format: Apply prettier --fix changes

📊 Changes

3 files changed (+47 additions, -43 deletions)

View changed files

📝 app/page.tsx (+14 -9)
📝 bun.lock (+32 -33)
📝 package.json (+1 -1)

📄 Description

Important

This is an automatic PR generated by Vercel to help you with patching efforts. We can't guarantee it's comprehensive, and it may contain mistakes. Please review our guidance before merging these changes.

A critical remote code execution (RCE) vulnerability in React Server Components, impacting frameworks such as Next.js, was identified in the project comfyui-embedded-workflow-editor. The vulnerability enables unauthenticated RCE on the server via insecure deserialization in the React Flight protocol.

This issue is tracked under:

This automated pull request upgrades the affected React and Next.js packages to patched versions that fully remediate the issue.

More Info | security@vercel.com

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/ComfyUI-embedded-workflow-editor/pull/13 **Author:** [@vercel[bot]](https://github.com/apps/vercel) **Created:** 2/1/2026 **Status:** ✅ Merged **Merged:** 2/1/2026 **Merged by:** [@snomiao](https://github.com/snomiao) **Base:** `main` ← **Head:** `vercel/react-server-components-cve-vu-6o8gxi` --- ### 📝 Commits (4) - [`601052f`](https://github.com/Comfy-Org/ComfyUI-embedded-workflow-editor/commit/601052f3e9be4d5be0c2eea138d6654599f340d2) Fix React Server Components CVE vulnerabilities - [`0ab7c69`](https://github.com/Comfy-Org/ComfyUI-embedded-workflow-editor/commit/0ab7c69c884b1cefd0cb5342e64b5eb30baf91f9) format: Apply prettier --fix changes - [`9d28088`](https://github.com/Comfy-Org/ComfyUI-embedded-workflow-editor/commit/9d28088e676e5c486382e51382d92e86c19de938) fix: Add type assertions for sflow chains to resolve TypeScript errors - [`4528056`](https://github.com/Comfy-Org/ComfyUI-embedded-workflow-editor/commit/4528056349987dbed62b8e09c0e8ba1b28c77005) format: Apply prettier --fix changes ### 📊 Changes **3 files changed** (+47 additions, -43 deletions) <details> <summary>View changed files</summary> 📝 `app/page.tsx` (+14 -9) 📝 `bun.lock` (+32 -33) 📝 `package.json` (+1 -1) </details> ### 📄 Description > [!IMPORTANT] > This is an automatic PR generated by Vercel to help you with patching efforts. We can't guarantee it's comprehensive, and it may contain mistakes. Please review our [guidance](https://vercel.link/additional-checks) before merging these changes. A critical remote code execution (RCE) vulnerability in React Server Components, impacting frameworks such as Next.js, was identified in the project [comfyui-embedded-workflow-editor](https://vercel.com/comfyui/comfyui-embedded-workflow-editor). The vulnerability enables unauthenticated RCE on the server via insecure deserialization in the React Flight protocol. This issue is tracked under: - GitHub Security Advisory: [GHSA-9qr9-h5gf-34mp](https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp) - React Advisory: [CVE-2025-55182](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components) - Next.js Advisory: [CVE-2025-66478](https://nextjs.org/blog/CVE-2025-66478) This automated pull request upgrades the affected React and Next.js packages to patched versions that fully remediate the issue. [More Info](https://vercel.link/cve-2025-55182-automated-pr) | security@vercel.com --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi 2026-10-26 22:00:53 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
dependabot/npm_and_yarn/npm_and_yarn-a415b051ba
vercel/react-server-components-cve-vu-6o8gxi
sno-mp3
bunlock
sno-url-import-support
6-unable-to-read-workflow-in-webp-image-previous-commit-works-fine
allow-paste-url
rh-webp
3-some-png-images-that-are-not-generated-by-comfyui-seem-not-to-work
rh-exif-fix
No results found.
Labels
Clear labels   
pull-request
Mirrored from GitHub Pull Request

No labels
pull-request
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Comfy-Org/ComfyUI-embedded-workflow-editor#13
No description provided.