Description
It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | node-red-dashboard | All versions prior to version 2.17.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | node-red-dashboard | < 2.17.0 | 2.17.0 | GHSA-xg59-m7wx-853q |