CVE-2024-12952

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-12952
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12952.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-12952
Published
2024-12-26T13:00:15.457Z
Modified
2026-07-15T01:49:01.390468898Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
melMass comfy_mtb Dependency endpoint.py run_command code injection
Details

A vulnerability classified as critical was found in melMass comfymtb up to 0.1.4. Affected by this vulnerability is the function runcommand of the file comfy_mtb/endpoint.py of the component Dependency Handler. The manipulation leads to code injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named d6e004cce2c32f8e48b868e66b89f82da4887dc3. It is recommended to apply a patch to fix this issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12952.json",
    "cwe_ids": [
        "CWE-74",
        "CWE-94"
    ],
    "cna_assigner": "VulDB"
}
References

Affected packages

Git / github.com/melmass/comfy_mtb

Affected ranges

Type
GIT
Repo
https://github.com/melmass/comfy_mtb
Events
Introduced
119b4d6e16c2a90db1664ccaac748507feb73ea0
Fixed
d6e004cce2c32f8e48b868e66b89f82da4887dc3
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0.1.0"
        },
        {
            "last_affected": "0.1.0"
        },
        {
            "introduced": "0.1.1"
        },
        {
            "last_affected": "0.1.1"
        },
        {
            "introduced": "0.1.2"
        },
        {
            "last_affected": "0.1.2"
        },
        {
            "introduced": "0.1.3"
        },
        {
            "last_affected": "0.1.3"
        },
        {
            "introduced": "0.1.4"
        },
        {
            "last_affected": "0.1.4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
v0.*
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12952.json"