Skip to content
OpenAdvisories

Package · npm

@node-red/runtime

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Low 3.5
    CVE-2021-21298

    Path traversal in Node-Red

    Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with `projects.read` per…

    node-red node-red @node-red/runtime npm
  • High 7.7
    CVE-2021-21297

    Prototype Pollution in Node-Red

    Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object wit…

    node-red node-red @node-red/runtime npm