GitHub Advisoryadvisory · npm

GHSA-m33v-338h-4v9f Path traversal in Node-Red

LOW Published 2021-02-26 Modified 2021-02-26 Official page ↗
Aliases
CVE-2021-21298
Ecosystem
npm
Packages
@node-red/runtime
Severity
Low
Weaknesses
CWE-22
Reviewed
2021-02-26

Affected packages

• npm @node-red/runtime: < 1.2.8 → fixed in 1.2.8

Description

Impact This vulnerability allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via the Projects API. Patches The issue has been patched in Node-RED 1.2.8 Workarounds The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED. The primary workaround is not give untrusted users read access to the Node-RED editor. For more information If you have any questions or comments about this advisory: • Email us at [email protected] Acknowledgements Thanks to the Tencent Woodpecker Security Team for disclosing this vulnerability.

Related

Alias · CVE (1)

  • CVE-2021-21298 Node-Red is a low-code programming for event-driven applications built using nodejs. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References