CVE-2021-21298

CVE-2021-21298 affects Node-RED up to v1.2.7 with a path traversal vulnerability via the Projects API. When the Projects feature is enabled, a user with projects.read can access arbitrary files through the Projects API. The issue has been fixed in Node-RED v1.2.8. The vulnerability applies only t...

CVE-2021-21297

Node-RED CVE-2021-21297 affects Node-RED 1.2.7 and earlier, with a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object, potentially altering Node-RED runtime behavior. The issue is fixed in version 1.2.8; a practical...