| Package | Affected versions | Patched versions |
|---|---|---|
| node-red-dashboard | < 2.17.0 | 2.17.0 |
| node-red-dashboard | < 2.17.0 | 2.17.0 |
It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free