TI-2021-04398 Aliases CVE-2021-21298 GHSA-m33v-338h-4v9f

Path traversal in Node-Red

LOW 31CWE-22Published 2021-02-26 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via the Projects API. The issue has been patched in Node-RED 1.2.8. The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED. The primary workaround is not give untrusted users read access to the Node-RED editor.

Why it matters now

EPSS 0.0108 65th percentileScored 2026-11-07

Fix Fixed node-red (node-red): 1.2.8@node-red/runtime (npm): 1.2.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
node-red	node-red	before 1.2.8	1.2.8	Patch available	CNA
—	@node-red/runtime (npm)	before 1.2.8	1.2.8	Patch available	GHSA-m33v-338h-4v9f

node-red Vendornode-red Affected before 1.2.8 Fixed in 1.2.8 Patch available CNA
@node-red/runtime (npm) Vendor— Affected before 1.2.8 Fixed in 1.2.8 Patch available GHSA-m33v-338h-4v9f

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:nodered:node-red::::::node.js::*	before 1.2.8	Vulnerable	node-red

cpe:2.3:a:nodered:node-red:*:*:*:*:*:node.js:*:* Versions before 1.2.8 Vulnerable ·node-red

Remediation

Fix · CNA node-red (node-red) Fixed in 1.2.8
Fix · GHSA-m33v-338h-4v9f @node-red/runtime (npm) Fixed in 1.2.8 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-21298
2026-10-03 Alias added: GHSA-m33v-338h-4v9f

References

Patch 1

https://github.com/node-red/node-red/commit/74db3e17d075f23d9c95d7871586cf461524c456

Advisory 3

Other 2

TI-2021-04397 Prototype Pollution in Node-Red CVSS 3.1HIGH 7.7
TI-2019-11706 Cross-site scripting in node-red CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences