Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default behaviour of the Node-RED runtime. The vulnerability is patched in the 1.2.8 release. A workaround is to ensure only authorized users are able to access the editor url.
The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
| Link | Tags |
|---|---|
| https://github.com/node-red/node-red/security/advisories/GHSA-xp9c-82x8-7f67 | third party advisory |
| https://www.npmjs.com/package/%40node-red/runtime | |
| https://www.npmjs.com/package/%40node-red/editor-api | |
| https://github.com/node-red/node-red/releases/tag/1.2.8 | third party advisory release notes |