Node Red
Monthly
Path traversal in Node-RED's library storage API (GET/POST /library/:lib/:type/*path) allows any authenticated user - including those holding read-only scoped API tokens - to read arbitrary files outside the library directory by injecting ../ sequences into the path parameter. Users with write-access credentials can escalate to remote code execution by writing attacker-controlled content to SSH authorized_keys files or system cron directories. This vulnerability is distinct from the previously patched CVE-2021-21298 (Projects API traversal), affects all published Node-RED versions per CPE wildcard, carries no vendor-released patch at time of analysis, and has no confirmed active exploitation or CISA KEV listing.
Node-Red is a low-code programming for event-driven applications built using nodejs. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Node-Red is a low-code programming for event-driven applications built using nodejs. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Path traversal in Node-RED's library storage API (GET/POST /library/:lib/:type/*path) allows any authenticated user - including those holding read-only scoped API tokens - to read arbitrary files outside the library directory by injecting ../ sequences into the path parameter. Users with write-access credentials can escalate to remote code execution by writing attacker-controlled content to SSH authorized_keys files or system cron directories. This vulnerability is distinct from the previously patched CVE-2021-21298 (Projects API traversal), affects all published Node-RED versions per CPE wildcard, carries no vendor-released patch at time of analysis, and has no confirmed active exploitation or CISA KEV listing.
Node-Red is a low-code programming for event-driven applications built using nodejs. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Node-Red is a low-code programming for event-driven applications built using nodejs. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.