Read the docs

node-red

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

node-red records in CISA KEV

No node-red vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Node-red 3 records LOW Node-red-dashboard 3 records MEDIUM

Records

6 records

TI-2021-04397 CVE-2021-21297 · GHSA-xp9c-82x8-7f67

Prototype Pollution in Node-Red

Priority LOW 36

Node-Red is a low-code programming for event-driven applications built using nodejs.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01397 Published 2021-02-26 Fixed in 1.2.8 CWE-1321
TI-2021-04398 CVE-2021-21298 · GHSA-m33v-338h-4v9f

Path traversal in Node-Red

Priority LOW 31

Node-Red is a low-code programming for event-driven applications built using nodejs.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0108 Published 2021-02-26 Fixed in 1.2.8 CWE-22
TI-2019-11706 CVE-2019-15607 · GHSA-8w65-xjc5-9w79

Cross-site scripting in node-red

Priority LOW 25

A stored XSS vulnerability is present within node-red (version: <= 0.20.7) npm package, which is a visual tool for wiring the Internet of Things.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00644 Published 2020-01-28 Fixed in 0.20.8 CWE-79
TI-2019-08021 CVE-2019-10756 · GHSA-xg59-m7wx-853q

Cross-site scripting in node-red-dashboard

Priority LOW 25

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0057 Published 2019-10-08 Fixed in 2.17.0 CWE-79
Open these records in search →