GitHub Advisoryadvisory · npm

GHSA-xp9c-82x8-7f67 Prototype Pollution in Node-Red

HIGH Published 2021-02-26 Modified 2021-09-22 Official page ↗
Aliases
CVE-2021-21297
Ecosystem
npm
Packages
@node-red/runtime
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Weaknesses
CWE-1321, CWE-915
Reviewed
2021-02-26

Affected packages

• npm @node-red/runtime: < 1.2.8 → fixed in 1.2.8

Description

Impact Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default behaviour of the Node-RED runtime. Patches The vulnerability is patched in the 1.2.8 release. Workarounds A workaround is to ensure only authorised users are able to access the editor url. For more information If you have any questions or comments about this advisory: • Email us at [email protected] Acknowledgements Thanks to the Tencent Woodpecker Security Team for disclosing this vulnerability.

Related

Alias · CVE (1)

  • CVE-2021-21297 Node-Red is a low-code programming for event-driven applications built using nodejs. vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness

References