@3c-node-red/runtime (3.1.6), @adeunis/node-red-contrib-adeunis-codecs (1.0.0) +340 more potentially affected by CVE-2026-77415 via jsonata (>=1.0.10, <=1.8.7)

jsonata NPM version =1.0.10, =0.0.1, =0.0.1, =0.0.1, =0.17.5, =20.2.3, =5.0.0-aws-sdk-v3.2, =0.0.1, =0.8.0, =0.0.1, =0.0.114 and more Source cves: CVE-2026-77415 Source advisory: GHSA-66MM-25PP-RFFF...

@3c-node-red/runtime (3.1.6), @adeunis/node-red-contrib-adeunis-codecs (1.0.0) +340 more potentially affected by CVE-2026-77414 via jsonata (>=1.0.10, <=1.8.7)

jsonata NPM version =1.0.10, =0.0.1, =0.0.1, =0.0.1, =0.17.5, =20.2.3, =5.0.0-aws-sdk-v3.2, =0.0.1, =0.8.0, =0.0.1, =0.0.114 and more Source cves: CVE-2026-77414 Source advisory: GHSA-2943-5XFG-GQ5F...

@3c-node-red/runtime (3.1.6), @adeunis/node-red-contrib-adeunis-codecs (1.0.0) +340 more potentially affected by CVE-2026-52746 via jsonata (>=1.0.10, <=1.8.8)

jsonata NPM version =1.0.10, =0.0.1, =0.0.1, =0.0.1, =0.17.5, =20.2.3, =5.0.0-aws-sdk-v3.2, =0.0.1, =0.8.0, =0.0.1, =0.0.114 and more Source cves: CVE-2026-52746 Source advisory: GHSA-86VW-MFPG-WWV9...

@3c-node-red/runtime (3.1.6), @adeunis/node-red-contrib-adeunis-codecs (1.0.0) +243 more potentially affected by CVE-2024-27307 via jsonata (>=1.5.0, <=1.8.6)

jsonata NPM version =1.5.0, =20.2.3, =5.0.0-aws-sdk-v3.2, =0.8.0, =0.0.1, =1.0.0, =1.0.1, =2.0.0, =2.0.4 - @elastic.io/batching-library 2.0.1-dev.4 and more Source cves: CVE-2024-27307 Source advisory: MEND:CVE-2024-27307...

Directory Traversal

@node-red/runtime is vulnerable to directory traversal. The vulnerability exists as users with the projects.read permission can access any file via the Projects API...

CVE-2021-21297

Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default...

@dolittle/node-red (>=2.0.0, <=2.2.8), @dolittle/node-red-infor-m3 (>=2.0.0, <=2.2.8) +13 more potentially affected by CVE-2021-21298 via @node-red/runtime (>=1.0.0-beta.1, <=1.2.7)

@node-red/runtime NPM version =1.0.0-beta.1, =2.0.0, =2.0.0, =7.0.0, =1.2.0, =0.1.1, =1.0.0-beta.1, =0.0.1, =0.0.3, =0.0.5, =0.0.2, =1.0.4, =1.0.1, =1.0.2 Source cves: CVE-2021-21298 Source advisory: OSV:GHSA-M33V-338H-4V9F...

@dolittle/node-red (>=2.0.0, <=2.2.8), @dolittle/node-red-infor-m3 (>=2.0.0, <=2.2.8) +13 more potentially affected by CVE-2021-21298 via @node-red/runtime (>=1.0.0-beta.1, <=1.2.7)

@node-red/runtime NPM version =1.0.0-beta.1, =2.0.0, =2.0.0, =7.0.0, =1.2.0, =0.1.1, =1.0.0-beta.1, =0.0.1, =0.0.3, =0.0.5, =0.0.2, =1.0.4, =1.0.1, =1.0.2 Source cves: CVE-2021-21298 Source advisory: GHSA-M33V-338H-4V9F...

@dolittle/node-red (>=2.0.0, <=2.2.8), @dolittle/node-red-infor-m3 (>=2.0.0, <=2.2.8) +13 more potentially affected by CVE-2021-21297 via @node-red/runtime (>=1.0.0-beta.1, <=1.2.7)

@node-red/runtime NPM version =1.0.0-beta.1, =2.0.0, =2.0.0, =7.0.0, =1.2.0, =0.1.1, =1.0.0-beta.1, =0.0.1, =0.0.3, =0.0.5, =0.0.2, =1.0.4, =1.0.1, =1.0.2 Source cves: CVE-2021-21297 Source advisory: OSV:GHSA-XP9C-82X8-7F67...

@dolittle/node-red (>=2.0.0, <=2.2.8), @dolittle/node-red-infor-m3 (>=2.0.0, <=2.2.8) +13 more potentially affected by CVE-2021-21297 via @node-red/runtime (>=1.0.0-beta.1, <=1.2.7)

@node-red/runtime NPM version =1.0.0-beta.1, =2.0.0, =2.0.0, =7.0.0, =1.2.0, =0.1.1, =1.0.0-beta.1, =0.0.1, =0.0.3, =0.0.5, =0.0.2, =1.0.4, =1.0.1, =1.0.2 Source cves: CVE-2021-21297 Source advisory: GHSA-XP9C-82X8-7F67...

Prototype Pollution

Overview Impact Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default behaviour of the Node-RED runtime. Workarounds A workaround is to...

@albcastillobeone/node-red-contrib-event-classifier (1.0.0), @dolittle/node-red (>=2.0.0, <=2.2.8) +28 more potentially affected by CVE-2021-21298 via @node-red/runtime (>=0.20.0-beta.2, <=1.2.7)

@node-red/runtime NPM version =0.20.0-beta.2, =2.0.0, =2.0.0, =1.1.0, =6.1.0-beta.1, =1.2.0, =0.1.1, =1.0.44, =2.7.2, =1.8.0, =0.20.0-beta.2, =0.0.1, =1.0.0, =1.0.20 and more Source cves: CVE-2021-21298 Source advisory: MEND:CVE-2021-21298...

@albcastillobeone/node-red-contrib-event-classifier (1.0.0), @dolittle/node-red (>=2.0.0, <=2.2.8) +28 more potentially affected by CVE-2021-21297 via @node-red/runtime (>=0.20.0-beta.2, <=1.2.7)

@node-red/runtime NPM version =0.20.0-beta.2, =2.0.0, =2.0.0, =1.1.0, =6.1.0-beta.1, =1.2.0, =0.1.1, =1.0.44, =2.7.2, =1.8.0, =0.20.0-beta.2, =0.0.1, =1.0.0, =1.0.20 and more Source cves: CVE-2021-21297 Source advisory: MEND:CVE-2021-21297...