Skip to content

Product

node-red @node-red/runtime vulnerabilities

2 published CVES affecting node-red @node-red/runtime, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
1
Medium
0
Low
0
Unscored
1
CISA KEV
0

Latest node-red @node-red/runtime CVEs

Newest publication first

  1. CVE-2021-21298 Path traversal in Node-Red

    Unknown EPSS 1.1%

    Impact This vulnerability allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with projects.read permission is able to access any file via the Projects API. Patches The issue has been patched in Node-RED 1.2.8 Workarounds The vulnerabi...

  2. CVE-2021-21297 Prototype Pollution in Node-Red

    HighCVSS 7.7 EPSS 1.4%

    Impact Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default behaviour of the Node-RED runtime. Patches The vulnerability...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.