From c19e49525be4ecdb3c55c07ec89c39ac82ffa9bd Mon Sep 17 00:00:00 2001
From: superboy-zjc <1826599908@qq.com>
Date: Thu, 5 Jun 2025 15:05:34 -0400
Subject: [PATCH] [fix] class pollution vulnerability

---
 comfy/utils.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/comfy/utils.py b/comfy/utils.py
index 1f8d71292..4695a2776 100644
--- a/comfy/utils.py
+++ b/comfy/utils.py
@@ -710,6 +710,8 @@ def safetensors_header(safetensors_path, max_size=100*1024*1024):
 def set_attr(obj, attr, value):
     attrs = attr.split(".")
     for name in attrs[:-1]:
+        if name.startswith("__") and name.endswith("__"):
+            raise ValueError("Cannot set attribute across dunder attributes")
         obj = getattr(obj, name)
     prev = getattr(obj, attrs[-1])
     setattr(obj, attrs[-1], value)
@@ -722,6 +724,8 @@ def copy_to_param(obj, attr, value):
     # inplace update tensor instead of replacing it
     attrs = attr.split(".")
     for name in attrs[:-1]:
+        if name.startswith("__") and name.endswith("__"):
+            raise ValueError("Cannot set attribute across dunder attributes")
         obj = getattr(obj, name)
     prev = getattr(obj, attrs[-1])
     prev.data.copy_(value)