Lucene search
GoogleOSV:GHSA-8W65-XJC5-9W79HistoryJan 30, 2020 - 9:00 p.m.
Cross-Site Scripting in node-red
2020-01-3021:00:21
Google
osv.dev
13
0.001 Low
EPSS
Percentile
25.0%
Versions of node-red prior to 0.20.8are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize the name field in new Flows, allowing attackers to execute arbitrary JavaScript in the victim’s browser.
Recommendation
Upgrade to version 0.18.6 or later.
Related
hackerone
hackerone
Node.js third-party modules: [node-red] Stored XSS within Flow's - "Name" field
2019-08-26 09:17:03
cve
cve
CVE-2019-15607
2020-01-28 03:15:10
osv
osv
CVE-2019-15607
2020-01-28 03:15:10
cvelist
cvelist
CVE-2019-15607
2020-01-28 02:13:16
nvd
nvd
CVE-2019-15607
2020-01-28 03:15:10
prion
prion
Cross site scripting
2020-01-28 03:15:00
github
github
Cross-Site Scripting in node-red
2020-01-30 21:00:21
veracode
veracode
Cross-Site Scripting (XSS)
2020-01-13 04:55:57