T08 · Insecure Dependencies
Error
- Location
- scripts/install_deps.py:78
- Finding
- Unpinned Remote Dependencies Permit Supply-Chain Code Execution<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install_deps.py:78-130` **Vulnerability Type**: Unpinned packages and mutable remote repository installation **Risk Level**: High ### Vulnerable Code ```python def install_python_packages(packages: list) -> dict: """Install Python packages.""" result = {"tool": "python_packages", "success": False, "packages": {}} for pkg in packages: try: subprocess.run( [sys.executable, "-m", "pip", "install", pkg], check=True, capture_output=True, timeout=120, ) result["packages"][pkg] = "installed" except subprocess.CalledProcessError as e: result["packages"][pkg] = f"installation failed: {e.stderr.decode()[:200]}" except Exception as e: result["packages"][pkg] = f"error: {e}" ``` ```python try: # Clone ComfyUI subprocess.run( ["git", "clone", "https://github.com/comfyanonymous/ComfyUI.git", str(target_path)], check=True, timeout=300, ) # Install dependencies requirements = target_path / "requirements.txt" if requirements.exists(): subprocess.run( [sys.executable, "-m", "pip", "install", "-r", str(requirements)], check=True, timeout=600, ) ``` ### Technical Analysis The installer obtains Python packages by name without version constraints or package hashes. It also clones the current default branch of ComfyUI without selecting or verifying a reviewed commit or signed release. It subsequently installs dependencies from the remotely retrieved `requirements.txt`. Consequently, the effective code installed by the Skill can change after the Skill itself has been reviewed. A compromised package release, package index, GitHub repository, maintainer account, or mutable dependency declaration could introduce arbitrary installation-time or runtime code. The module documentation states that user confirm ...[truncated 1552 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every direct dependency to an exact reviewed version. 2. Maintain a lock file with hashes and install with hash verification, for example: ```bash python -m pip install --require-hashes -r requirements.lock ``` 3. Pin ComfyUI to a reviewed immutable commit or signed release: ```bash git clone --no-checkout https://github.com/comfyanonymous/ComfyUI.git git checkout <reviewed-commit-hash> ``` 4. Verify the checked-out commit and, where available, validate signed tags or release artifacts. 5. Review and lock ComfyUI's transitive dependencies rather than directly installing a mutable remote `requirements.txt`. 6. Install Python packages inside an isolated virtual environment with no administrative privileges. 7. Add an actual interactive confirmation prompt that displays the exact source, version, destination, and commands before making changes. 8. Require a separate explicit flag such as `--yes` for non-interactive operation. 9. Avoid invoking package managers through `sudo` automatically. Instead, print the command and require the user to perform privileged installation separately. 10. Record dependency provenance and verify downloaded artifacts against expected checksums. ]]>