Cross-Site Scripting in node-red

ALTOGHSA-5g6j-8hv4-vfgj · Published 11/09/2020 · updated 31/08/2020

Em resumo

GHSA-5g6j-8hv4-vfgj é uma vulnerabilidade ALTO que afeta node-red.
Correção: atualize para 0.18.6 ou posterior.

Package	Affected versions	Patched versions
node-red npm	`< 0.18.6`	`0.18.6`

Description

Versions of node-red prior to 0.18.6 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize the name field in new items, allowing attackers to execute arbitrary JavaScript in the victim's browser.

Recommendation

Upgrade to version 0.18.6 or later.

References

hackerone.com/reports/349146 · WEB
npmjs.com/advisories/993 · WEB

Mais vulnerabilidades de node-red

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free