Cross-Site Scripting Vulnerability in node-red
Summary
GHSA-5g6j-8hv4-vfgj: Cross-Site Scripting in node-red. Affects node-red versions < 0.18.6. Fixed in 0.18.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node-RED is an open-source flow-based programming tool that allows users to create applications by wiring together hardware devices, APIs, and online services. It provides a web-based interface for visually designing and deploying flows. However, versions of node-red prior to 0.18.6 are vulnerable to Cross-Site Scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in node-red arises from a failure to properly sanitize the name field in new items. This allows attackers to inject and execute arbitrary JavaScript code in the victim's browser. By exploiting this vulnerability, an attacker can potentially steal sensitive information, perform actions on behalf of the victim, or manipulate the victim's browsing experience.
How To Fix
Latest published version: 5.0.9 as of 23 Oct 2026
npm install node-red@5.0.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.18.6
This is the first release that contains the fix.
npm install node-red@0.18.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the Cross-Site Scripting vulnerability in node-red can be mitigated by upgrading to version 0.18.6 or later. It is important to promptly address this vulnerability to prevent potential exploitation and protect user data. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-red →
FAQ
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can be used to steal sensitive information, perform actions on behalf of the victim, or manipulate the victim's browsing experience.
The XSS vulnerability in node-red allows attackers to execute arbitrary JavaScript code in the victim's browser. This can lead to various consequences such as data theft, unauthorized actions, and manipulation of the victim's browsing experience.
No, only versions prior to 0.18.6 of node-red are vulnerable to this XSS issue. It is recommended to upgrade to version 0.18.6 or later to mitigate the risk.
No specific workaround has been provided for this vulnerability. It is advised to upgrade to the fixed version of node-red to address the XSS vulnerability.
You can find more information about this vulnerability in the GitHub Advisory Database. The link to the advisory is provided in the 'affected' section of this report.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-red.
