GHSA-xg59-m7wx-853q
Cross-site Scripting in node-red-dashboard
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | node-red-dashboard | < 2.17.0 | 2.17.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default.
References
External links from the advisory. They lead to third-party sites.