Malicious code in node-red-contrib-modbusio (npm)

The package node-red-contrib-modbusio was found to contain malicious code...

Malicious code in @zalastax/nolb-node-red-2 (npm)

The package @zalastax/nolb-node-red-2 was found to contain malicious code...

MAL-2025-12675 Malicious code in @zalastax/nolb-node-red-contrib-i (npm)

The package @zalastax/nolb-node-red-contrib-i was found to contain malicious code...

MAL-2025-12669 Malicious code in @zalastax/nolb-node-red-contrib-c (npm)

The package @zalastax/nolb-node-red-contrib-c was found to contain malicious code...

MAL-2025-12661 Malicious code in @zalastax/nolb-node-red-contl (npm)

The package @zalastax/nolb-node-red-contl was found to contain malicious code...

MAL-2025-27650 Malicious code in node-red-contrib-xmlc14n (npm)

The package node-red-contrib-xmlc14n was found to contain malicious code...

Malicious code in node-red-contrib-flows_splitter (npm)

The package node-red-contrib-flowssplitter was found to contain malicious code...

Malicious code in node-red-contrib-storfly-vtview (npm)

The package node-red-contrib-storfly-vtview was found to contain malicious code...

MAL-2025-12654 Malicious code in @zalastax/nolb-node-red-cl (npm)

The package @zalastax/nolb-node-red-cl was found to contain malicious code...

MAL-2025-12663 Malicious code in @zalastax/nolb-node-red-contrib-1 (npm)

The package @zalastax/nolb-node-red-contrib-1 was found to contain malicious code...

MAL-2025-12650 Malicious code in @zalastax/nolb-node-red-ca (npm)

The package @zalastax/nolb-node-red-ca was found to contain malicious code...

MAL-2025-12666 Malicious code in @zalastax/nolb-node-red-contrib-5 (npm)

The package @zalastax/nolb-node-red-contrib-5 was found to contain malicious code...

MAL-2025-12678 Malicious code in @zalastax/nolb-node-red-contrib-l (npm)

The package @zalastax/nolb-node-red-contrib-l was found to contain malicious code...

The vulnerability of the Node-RED visual programming tool’s server on the Pilz IndustrialPI operating system allows a perpetrator to execute arbitrary commands.

The vulnerability of the Node-RED visual programming tool on the Pilz IndustrialPI industrial computer server is related to the absence of default authentication settings. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2025-41656

CVE-2025-41656 concerns the Pilz IndustrialPI Node-RED integration, where the authentication for the Node-RED server is not configured by default. This allows an unauthenticated remote attacker to execute arbitrary commands with high privileges on affected devices. The CVSS 3.1 base score is 10.0...

CVE-2025-41656 Pilz: Missing Authentication in Node-RED integration

An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the NodeRED server is not configured by default...

CVE-2025-41656 Pilz: Missing Authentication in Node-RED integration

An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the NodeRED server is not configured by default...

Pilz IndustrialPI 访问控制错误漏洞

Pilz IndustrialPI is a gateway for the Industrial Internet of Things from Pilz Individual Developers in Germany. An access control error vulnerability exists in Pilz IndustrialPI that stems from the default unconfigured NodeRED server authentication leading to command execution...

PT-2025-27509 · Node Red · Node-Red

Name of the Vulnerable Software and Affected Versions: Node RED affected versions not specified Description: An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the Node RED server is not configured by default...

CVE-2022-3783

A vulnerability, which was classified as problematic, has been found in node-red-dashboard. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component uitext Format Handler. The manipulation leads to cross site scripting. The attack may be...