An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXhwOWMtODJ4OC03ZjY3
Prototype Pollution in Node-Red
The vulnerability is patched in the 1.2.8 release.
A workaround is to ensure only authorised users are able to access the editor url.
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected]
Thanks to the Tencent Woodpecker Security Team for disclosing this vulnerability.Permalink: https://github.com/advisories/GHSA-xp9c-82x8-7f67
Source: GitHub Advisory Database
Published: over 2 years ago
Updated: 8 months ago
CVSS Score: 7.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Identifiers: GHSA-xp9c-82x8-7f67, CVE-2021-21297
Fixed in: 1.2.8