From fd7287fe61f02dfaeb0b93794d5fac7c1622b020 Mon Sep 17 00:00:00 2001 From: Thomas Ward Date: Mon, 9 Dec 2024 11:28:25 -0500 Subject: [PATCH] Hard-enforce ultralytics <= 8.3.40. --- main.py | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/main.py b/main.py index 5535622d6..e1c949fdd 100644 --- a/main.py +++ b/main.py @@ -7,6 +7,23 @@ import folder_paths import time from comfy.cli_args import args from app.logger import setup_logger +from packaging.version import Version + + +# Security: Hard-pin ultralytics to 8.3.40, enforce as a test during ComfyUI startup. If ultralytics exists, 8.3.40 is last "okay" version. +# Refer to following: +# - https://github.com/ultralytics/ultralytics/issues/18027 +# - https://blog.comfy.org/comfyui-statement-on-the-ultralytics-crypto-miner-situation/ +try: + from ultralytics import __version__ as ultralytics_version + if Version(ultralytics_version) > Version('8.3.40'): + raise EnvironmentError("[SECURITY ALERT] Unsafe malicious versions of Ultralytics detected, last known good version 8.3.40.") +except ModuleNotFound: + pass +except Exception: + raise + + if __name__ == "__main__": #NOTE: These do not do anything on core ComfyUI which should already have no communication with the internet, they are for custom nodes.