{"action":"Upgrade comfyui-manager to 3.38 or later.","affected":[{"fixed":"3.38","introduced":"0"}],"component":"comfyui-manager","cve_ids":["CVE-2025-67303"],"ecosystem":"PyPI","epss":0.01392,"exploited":false,"fixed_versions":["3.38"],"ghsa_id":"GHSA-95pq-hr8p-f5g7","id":"tcs_01M5KGZCHWQN4RYG6ZD42H6XR3","modified_at":"2026-07-13T16:32:36.303971942Z","published_at":"2026-07-13T15:46:22.621639Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2422","https://github.com/Comfy-Org/ComfyUI-Manager/security/advisories/GHSA-95pq-hr8p-f5g7","https://nvd.nist.gov/vuln/detail/CVE-2025-67303","https://github.com/Comfy-Org/ComfyUI-Manager/pull/2338/commits/e44c5cef58fb4973670b86433b9d24d077b44a26","https://github.com/Comfy-Org/ComfyUI-Manager","https://github.com/Comfy-Org/ComfyUI-Manager/blob/main/docs/en/v3.38-userdata-security-migration.md","https://pypi.org/project/comfyui-manager","https://github.com/advisories/GHSA-95pq-hr8p-f5g7"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-2422","url":"https://osv.dev/vulnerability/PYSEC-2026-2422"}],"summary":"ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)"}