node-red-contrib-ale-rainbow (>=1.82.3, <=1.82.6) potentially affected by CVE-2022-3783 via node-red-dashboard (3.1.7)

node-red-dashboard NPM version 3.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on node-red-dashboard and may be impacted: - node-red-contrib-ale-rainbow =1.82.3, =1.82.6 Source cves: CVE-2022-3783 Source advisory: OSV:GHSA-VRV9-3X3W-FFXW...

CVE-2022-3783

creationtimestamp| type| source ---|---|--- 2022-10-31 23:13:28+00:00| seen| https://t.me/cibsecurity/52321...

CVE-2022-3783 node-red-dashboard ui_text Format ui-component-ctrl.js cross site scripting

A vulnerability, which was classified as problematic, has been found in node-red-dashboard. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component uitext Format Handler. The manipulation leads to cross site scripting. The attack may be...

CVE-2022-3783

The CVE-2022-3783 issue affects node-red-dashboard, specifically the ui_text Format Handler’s file components/ui-component/ui-component-ctrl.js. The vulnerability enables cross-site scripting (XSS) and could be exploited remotely. Public references indicate a patch exists (patch SHA 9305d1a82f19b...