Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: node-red Clear all filters
TI-2021-04398 CVE-2021-21298 · GHSA-m33v-338h-4v9f

Path traversal in Node-Red

Priority LOW 31

Node-Red is a low-code programming for event-driven applications built using nodejs.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0108 Published 2021-02-26 Fixed in 1.2.8 CWE-22
TI-2021-04397 CVE-2021-21297 · GHSA-xp9c-82x8-7f67

Prototype Pollution in Node-Red

Priority LOW 36

Node-Red is a low-code programming for event-driven applications built using nodejs.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01397 Published 2021-02-26 Fixed in 1.2.8 CWE-1321
TI-2019-11706 CVE-2019-15607 · GHSA-8w65-xjc5-9w79

Cross-site scripting in node-red

Priority LOW 25

A stored XSS vulnerability is present within node-red (version: <= 0.20.7) npm package, which is a visual tool for wiring the Internet of Things.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00644 Published 2020-01-28 Fixed in 0.20.8 CWE-79
TI-2019-08021 CVE-2019-10756 · GHSA-xg59-m7wx-853q

Cross-site scripting in node-red-dashboard

Priority LOW 25

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0057 Published 2019-10-08 Fixed in 2.17.0 CWE-79