Custom Nodes execute Python code - Are they safe?

[Ruffy314]

After dabbling with my own custom nodes I got worried. Can they harm my system?
Can they import all modules? Gain full access to the file system, or download code from any source? The pickle attacks from SD-Checkpoints come to mind.
I have downloaded several custom node packs from other people (mostly through the manager), and I lack the experience and understanding to check them for attacks. Are they restricted by the UI to safe modules / APIs?

[comfyanonymous]

They can run any python code they want however usually the code is very short so it's easy to audit them.