Nodered

CVE-2022-3783 Oct 31, 21:15 npm MEDIUM POC PATCH This Month

A vulnerability, which was classified as problematic, has been found in node-red-dashboard.js of the component ui_text Format Handler. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2021-21298 Feb 26, 17:15 npm MEDIUM PATCH This Month

Node-Red is a low-code programming for event-driven applications built using nodejs. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.

CVE-2021-21297 Feb 26, 17:15 npm MEDIUM PATCH This Month

Node-Red is a low-code programming for event-driven applications built using nodejs. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2021-3223 Jan 26, 18:16 npm HIGH POC PATCH THREAT This Week

Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2019-10756 Oct 08, 19:15 npm MEDIUM POC PATCH This Month

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.