~ / search / GHSA-xp9c-82x8-7f67

GHSA-xp9c-82x8-7f67

Prototype Pollution in Node-Red

Source: GitHub Advisory Database (reviewed) High CVE-2021-21297

Packages

EcosystemPackageAffectedFixed in
npm @node-red/runtime < 1.2.8 1.2.8

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default behaviour of the Node-RED runtime. ### Patches The vulnerability is patched in the 1.2.8 release. ### Workarounds A workaround is to ensure only authorised users are able to access the editor url. ### For more information If you have any questions or comments about this advisory: * Email us at [[email protected]](mailto:[email protected]) ### Acknowledgements Thanks to the Tencent Woodpecker Security Team for disclosing this vulnerability.

References

External links from the advisory. They lead to third-party sites.