🐍 Execute python (UNSAFE)

FlowNodes' "Execute python" node is a full Python interpreter dropped into the middle of your graph. You type code into the box, it runs via Python's exec() with your user privileges, and anything you assign to out comes back out the socket. It's the escape hatch that makes every other node in this pack redundant - and it's the reason that node label has "(UNSAFE)" and the warning that would fit in a headline.

The name is not marketing. Custom nodes already run arbitrary code when ComfyUI loads them, so the ecosystem's stance is blunt: installing a node from an untrusted workflow is like running a downloaded executable. This node turns that from a background risk into a feature you deliberately use - which is fine when you wrote the code, and dangerous when you loaded someone else's workflow. If a shared workflow contains one of these, read the code before you run it, or don't run it.

How it works

The Value box defaults to out = input0 - pass-through. You have one connected input, Input (optional). Here's the mechanism detail that matters:

• If Input is a plain value, it lands in the script as the variable input0.
• If Input is a dict - which is exactly what the 🐍 Stack python exec parameters node produces - the dict's keys become local variables. Stack parameters, connect its output to Input, and every stacked value is available by name.

The script's out variable is what gets returned as Output. Assign nothing and you get None out.

Two execution facts worth knowing: the code runs with an empty globals namespace (built-ins like print and len still work), and there's a Flow input/output so the node participates in FlowNodes' ordering system - set your flow, run your script, pass the flow on.

The red-flag mechanic

FlowNodes ships a small frontend extension that watches this node's text box. If your code contains a line starting with import, the node's body turns red. That's the author's tripwire: imports are the usual first step of something reading files, hitting the network, or reaching outside the sandbox-less process. The check is a regex on ^[ \t]*import\s* - a quick heuristic, not a security boundary. A script can do plenty of damage without an import line, so treat the red as "extra careful," never as "this is the only unsafe thing."

What people actually do with it

• Shape-shift data: out = [str(x) for x in input0], JSON parsing, list transforms.
• Do math the expression nodes can't express: out = sum(input0), loops, string manipulation.
• Drive logic the graph would need a dozen nodes for.
• Coordinate with the 🔺 persistent dict for cross-run state.

Keep scripts short. A 200-line Python program belongs in a file, not a ComfyUI node.

Install

cd ComfyUI/custom_nodes
git clone https://github.com/gitmylo/FlowNodes
# restart ComfyUI

or ComfyUI Manager → search FlowNodes → install. No Python dependencies, no models - the node uses only the standard library.

Troubleshooting

• NameError: name 'input0' is not defined - you referenced input0 without connecting the Input socket. Connect it, or use Stack parameters to pass named variables.
• Output is always None - you never assigned out. The node reads loc['out'], and its default is None.
• Node is red - your script has an import line. Fine if intentional; if you didn't write it, that's the cue to stop and read the whole script.
• Code "runs" but downstream doesn't update - the no_cache input forces re-execution; make sure it's present in your version, and remember flow ordering if you're chaining.
• Script errors - the traceback prints to the ComfyUI console, not the canvas. Check your terminal.