ComfyUI-Copilot Workflow Checkpoint Restore Handler — Improper Control of Resource Identifiers (CWE-99)

#!/usr/bin/env python3
# check_cve_2026_13493.py
# Detects vulnerable installs of AIDC-AI/ComfyUI-Copilot (<= 2.0.28).
# Exit codes: 0=PATCHED/NotInstalled, 1=VULNERABLE, 2=UNKNOWN

import os, re, sys, json
from pathlib import Path

VULN_MAX = (2, 0, 28)   # inclusive: every version <= 2.0.28 is affected

def parse_version(v):
    m = re.match(r"(\d+)\.(\d+)\.(\d+)", v.strip().lstrip("vV"))
    return tuple(int(x) for x in m.groups()) if m else None

def find_copilot_roots(base):
    roots = []
    for p in Path(base).rglob("ComfyUI-Copilot"):
        if p.is_dir():
            roots.append(p)
    return roots

def extract_version(root):
    # Try common locations in order.
    candidates = [
        root / "pyproject.toml",
        root / "setup.py",
        root / "package.json",
        root / "__init__.py",
        root / "VERSION",
    ]
    for c in candidates:
        if not c.exists():
            continue
        try:
            text = c.read_text(errors="ignore")
        except Exception:
            continue
        if c.name == "package.json":
            try:
                v = json.loads(text).get("version")
                if v: return v
            except Exception:
                pass
        m = re.search(r"version\s*=\s*[\"']([0-9]+\.[0-9]+\.[0-9]+)", text, re.I)
        if m: return m.group(1)
        m = re.search(r"__version__\s*=\s*[\"']([0-9]+\.[0-9]+\.[0-9]+)", text)
        if m: return m.group(1)
    return None

def main():
    base = sys.argv[1] if len(sys.argv) > 1 else "."
    if not Path(base).exists():
        print(f"UNKNOWN: path not found: {base}")
        return 2
    roots = find_copilot_roots(base)
    if not roots:
        print("PATCHED: ComfyUI-Copilot not installed under", base)
        return 0
    worst = 0
    for r in roots:
        v = extract_version(r)
        if not v:
            print(f"UNKNOWN: {r} — version not determinable")
            worst = max(worst, 2)
            continue
        parsed = parse_version(v)
        if parsed is None:
            print(f"UNKNOWN: {r} — version string {v!r} unparseable")
            worst = max(worst, 2)
            continue
        status = "VULNERABLE" if parsed <= VULN_MAX else "PATCHED"
        print(f"{status}: {r} (version {v})")
        if status == "VULNERABLE":
            worst = max(worst, 1)
    return worst

if __name__ == "__main__":
    sys.exit(main())