GCVE - cpe:2.3:a:nodered:node-red:*:*:*:*:*:node.js:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:nodered:node-red:*:*:*:*:*:node.js:*:*

part: a version: * update: *

Vendor	Nodered (`c8c83eee-4312-5b59-b0d1-855c342d51ee`)
Product	Node Red (`78d64fcd-5baa-5597-bffa-f6c930d8aaa5`)
Edition	*
Language	*
Software edition	*
Target software	node.js
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:docker/nodered/node-red`	purl2cpe	2026-06-01 10:11:00.228524
`pkg:github/node-red/node-red`	purl2cpe	2026-06-01 10:11:00.228526
`pkg:npm/node-red`	purl2cpe	2026-06-01 10:11:00.228528
`pkg:rpm/opensuse/nodejs-node-red`	purl2cpe	2026-06-01 10:11:00.228529

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-21298`	vulnerable	2026-06-08 05:29:11.569896	Path traversal in Node-Red LOW (3.5) Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via the Projects API. The issue has been patched in Node-RED 1.2.8. The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED. The primary workaround is not give untrusted users read access to the Node-RED editor. Published: 2021-02-26T16:25:14.000Z Updated: 2024-08-03T18:09:15.856Z Open on db.gcve.eu Reference links https://www.npmjs.com/package/%40node-red/runtime https://github.com/node-red/node-red/releases/tag/1.2.8 https://github.com/node-red/node-red/security/advisories/GHSA-m33v-338h-4v9f https://github.com/node-red/node-red/commit/74db3e17d075f23d9c95d7871586cf461524c456	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21297`	vulnerable	2026-06-08 05:29:11.569400	Prototype Pollution in Node-Red HIGH (7.7) Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default behaviour of the Node-RED runtime. The vulnerability is patched in the 1.2.8 release. A workaround is to ensure only authorized users are able to access the editor url. Published: 2021-02-26T16:20:17.000Z Updated: 2024-08-03T18:09:15.688Z Open on db.gcve.eu Reference links https://github.com/node-red/node-red/security/advisories/GHSA-xp9c-82x8-7f67 https://www.npmjs.com/package/%40node-red/runtime https://www.npmjs.com/package/%40node-red/editor-api https://github.com/node-red/node-red/releases/tag/1.2.8	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-15607`	vulnerable	2026-06-08 05:12:57.679873	Details available A stored XSS vulnerability is present within node-red (version: <= 0.20.7) npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc. Published: 2020-01-28T02:13:16.000Z Updated: 2024-08-05T00:49:13.677Z Open on db.gcve.eu Reference links https://hackerone.com/reports/681986	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.