Path traversal in Node-Red

TRUNG BÌNH 6.5CVE-2021-21298 · GHSA-m33v-338h-4v9f · Công bố 26/02/2021 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2021-21298 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng node-red (nodered), @node-red/runtime.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.1%, cao hơn 65.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.2.8 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
node-red nodered	`< 1.2.8`	`1.2.8`
@node-red/runtime npm	`< 1.2.8`	`1.2.8`

Mô tả

Impact

This vulnerability allows arbitrary path traversal via the Projects API.

If the Projects feature is enabled, a user with projects.read permission is able to access any file via the Projects API.

Patches

The issue has been patched in Node-RED 1.2.8

Workarounds

The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED.

The primary workaround is not give untrusted users read access to the Node-RED editor.

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

Acknowledgements

Thanks to the Tencent Woodpecker Security Team for disclosing this vulnerability.

Mô tả của NVD

Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via the Projects API. The issue has been patched in Node-RED 1.2.8. The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED. The primary workaround is not give untrusted users read access to the Node-RED editor.