| Package | Affected versions | Patched versions |
|---|---|---|
| node-red | < 1.2.8 | 1.2.8 |
| @node-red/runtime | < 1.2.8 | 1.2.8 |
This vulnerability allows arbitrary path traversal via the Projects API.
If the Projects feature is enabled, a user with projects.read permission is able to access any file via the Projects API.
The issue has been patched in Node-RED 1.2.8
The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED.
The primary workaround is not give untrusted users read access to the Node-RED editor.
If you have any questions or comments about this advisory:
Thanks to the Tencent Woodpecker Security Team for disclosing this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free