Manual review request for flagged ComfyUI-List-Utils versions 2.0.0 and 2.1.0

[godmt]

Summary

The following versions of comfyui-list-utils were successfully published but are currently marked as NodeVersionStatusFlagged:

• 2.0.0
• 2.1.0

Because these versions are flagged, the Registry and ComfyUI Manager continue to show 1.5.0 as the latest active version.

Publisher and node

• Publisher: godmt
• Node ID: comfyui-list-utils
• Registry: https://registry.comfy.org/publishers/godmt/nodes/comfyui-list-utils
• Repository: https://github.com/godmt/ComfyUI-List-Utils

Affected versions

Version 2.1.0

• Version ID: 6403c5e2-c7a8-4abd-a3c2-c7073dea6097
• Published: June 25, 2026
• Status: NodeVersionStatusFlagged

Version 2.0.0

• Version ID: 675ff4b1-2b7f-44ac-ae0f-cdc7b2aee892
• Published: June 23, 2026
• Status: NodeVersionStatusFlagged

Flag reason

The scanner detected the following intentional dynamic execution code in nodes.py:

exec(exec_str)

The reported detection is:

• Issue type: python_dynamic_execution
• Admin tag: any-code-execute
• Scanner: yara_scan

This code belongs to the node's Exec feature, which intentionally allows a user to execute Python expressions inside a ComfyUI workflow.

The feature is not executed automatically and only evaluates code explicitly entered into the node by the workflow user. Its description also warns users to use it only with trusted workflows:

Execute Python code with input values available as x[0], x[1], ... and return result. Use only in trusted workflows.

Request

Could you please manually review versions 2.0.0 and 2.1.0 and confirm whether they can be approved as active versions?

If additional safeguards, documentation, or implementation changes are required for nodes that intentionally provide dynamic code execution, please let me know.

Thank you.