npm node-red-dashboard vulnerabilities

Latest npm node-red-dashboard CVEs

Newest publication first

1. CVE-2022-3783 node-red-dashboard ui_text Format ui-component-ctrl.js cross site scripting

   Published 2022-10-31

   Medium·CVSS 6.1 EPSS 0.83%

   A vulnerability, which was classified as problematic, has been found in node-red-dashboard. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component ui_text Format Handler. The manipulation leads to cross site scripting....

2. CVE-2021-3223 Path traversal in Node-RED-Dashboard

   Published 2021-01-26

   High·CVSS 7.5 EPSS 18.9%

   Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files.

3. CVE-2019-10756 Cross-site Scripting in node-red-dashboard

   Published 2019-10-08

   Medium·CVSS 5.4 EPSS 0.57%

   It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.