Prototype Pollution

2021-03-0109:31:59

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

34.5%

JSON

node-red is vulnerable to prototype pollution. It does not make sure to prevent unauthorized user to access the editor url, allowing an attacker to send a badly formed request to modify the Node-RED runtime behaviour.

CPENameOperatorVersion
@node-red/editor-apile1.2.7
@node-red/runtimele1.2.7
@node-red/editor-apile1.2.7
@node-red/runtimele1.2.7

Name	Operator	Version
@node-red/editor-api	le	1.2.7
@node-red/runtime	le	1.2.7
@node-red/editor-api	le	1.2.7
@node-red/runtime	le	1.2.7

References

github.com/node-red/node-red/releases/tag/1.2.8

github.com/node-red/node-red/security/advisories/GHSA-xp9c-82x8-7f67

www.npmjs.com/package/@node-red/editor-api

www.npmjs.com/package/@node-red/runtime

0.001 Low

EPSS

Percentile

34.5%

JSON

Related for VERACODE:29534