CVE-2019-15607: Cross-Site Scripting in node-red
Summary
CVE-2019-15607: Cross-Site Scripting in node-red. Affects node-red versions < 0.20.8. Fixed in 0.20.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node-RED is an open-source flow-based programming tool that allows users to create applications by wiring together hardware devices, APIs, and online services. It provides a web-based interface for visually creating and managing flows. Node-RED versions prior to 0.20.8 are vulnerable to Cross-Site Scripting (XSS) attacks. This vulnerability arises from the package's failure to properly sanitize the 'name' field in new Flows, enabling attackers to execute arbitrary JavaScript code in the victim's browser.
Vulnerability Detail
The Cross-Site Scripting (XSS) vulnerability in Node-RED allows an attacker to inject malicious JavaScript code into the application, which is then executed in the context of the victim's browser. This can lead to various consequences, including unauthorized access to sensitive information, session hijacking, and the ability to perform actions on behalf of the victim. The vulnerability is rated as MODERATE severity and has been assigned the Common Weakness Enumeration (CWE) ID CWE-79.
How To Fix
Minimum fixed version
0.20.8
This is the first release that contains the fix.
npm install node-red@0.20.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Node-RED versions prior to 0.20.8 are vulnerable to Cross-Site Scripting (XSS) attacks. It is crucial to upgrade to version 0.20.8 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for node-red →
FAQ
Node-RED is an open-source flow-based programming tool used for creating applications by connecting hardware devices, APIs, and online services.
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
This vulnerability allows attackers to execute arbitrary JavaScript code in the victim's browser, potentially leading to unauthorized access, session hijacking, and other malicious activities.
To fix this vulnerability, it is recommended to upgrade to version 0.20.8 or later of Node-RED.
No specific workaround has been provided for this vulnerability. It is best to upgrade to the latest version of Node-RED.
Related vulnerabilities
Recent vulnerabilities recorded for node-red.
