{"action":"Upgrade comfyui-manager to 3.38 or later.","affected":[{"fixed":"3.38","introduced":"0"}],"component":"comfyui-manager","cve_ids":["CVE-2025-67303"],"ecosystem":"PyPI","epss":0.01392,"exploited":false,"fixed_versions":["3.38"],"ghsa_id":"GHSA-95pq-hr8p-f5g7","id":"tcs_01M5KF9WAGTQE393P6X3V11HVQ","modified_at":"2026-07-13T16:43:17.423280799Z","published_at":"2026-06-22T19:58:24Z","references":["https://osv.dev/vulnerability/GHSA-95pq-hr8p-f5g7","https://github.com/Comfy-Org/ComfyUI-Manager/security/advisories/GHSA-95pq-hr8p-f5g7","https://nvd.nist.gov/vuln/detail/CVE-2025-67303","https://github.com/Comfy-Org/ComfyUI-Manager/pull/2338/commits/e44c5cef58fb4973670b86433b9d24d077b44a26","https://github.com/Comfy-Org/ComfyUI-Manager","https://github.com/Comfy-Org/ComfyUI-Manager/blob/main/docs/en/v3.38-userdata-security-migration.md"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-95pq-hr8p-f5g7","url":"https://osv.dev/vulnerability/GHSA-95pq-hr8p-f5g7"}],"summary":"ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)"}