Path Traversal in node-red-contrib-huemagic

ALTO 7.5CVE-2021-25864 · GHSA-frpw-jrwx-hcfv · Published 26/01/2021 · updated 17/06/2026

In breve

CVE-2021-25864 è una vulnerabilità ALTO (CVSS 7.5) che riguarda huemagic (dgtl), node-red-contrib-huemagic.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 9.3%, superiore al 95.4% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
huemagic dgtl	`= 3.0.0`	No fix yet
node-red-contrib-huemagic npm	`≤ 3.0.0`	No fix yet

Description

node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary file.

NVD description

node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary file.

References

nvd.nist.gov/vuln/detail/CVE-2021-25864 · ADVISORY
Foddy/node-red-contrib-huemagic · WEB
Foddy/node-red-contrib-huemagic · PACKAGE

Altre vulnerabilità di huemagic

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free