Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:npm/node-red@0.18.6
purl pkg:npm/node-red@0.18.6
Next non-vulnerable version 1.2.8
Latest non-vulnerable version 1.2.8
Risk 4.0
Vulnerabilities affecting this package (3)
Vulnerability Summary Fixed by
VCID-gh2h-q3t6-ebeb
Aliases:
CVE-2019-15607
GHSA-8w65-xjc5-9w79
Cross-site Scripting A stored XSS vulnerability is present within the node-red npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc.
0.20.8
Affected by 2 other vulnerabilities.
VCID-h7v4-5z1t-aqbk
Aliases:
CVE-2021-21297
GHSA-xp9c-82x8-7f67
Improperly Controlled Modification of Dynamically-Determined Object Attributes Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default behaviour of the Node-RED runtime. The vulnerability is patched in the release. A workaround is to ensure only authorized users are able to access the editor url.
1.2.8
Affected by 0 other vulnerabilities.
VCID-m5kp-t88v-fufu
Aliases:
CVE-2021-21298
GHSA-m33v-338h-4v9f
Path Traversal Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via the Projects API. The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED. The primary workaround is not give untrusted users read access to the Node-RED editor.
1.2.8
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-1y32-5wc9-4uhv Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in node-red. GHSA-5g6j-8hv4-vfgj
GMS-2020-752

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-05T21:14:11.642201+00:00 GHSA Importer Fixing VCID-1y32-5wc9-4uhv https://github.com/advisories/GHSA-5g6j-8hv4-vfgj 38.6.0
2026-06-04T20:45:39.726310+00:00 GitLab Importer Affected by VCID-h7v4-5z1t-aqbk https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/node-red/CVE-2021-21297.yml 38.6.0
2026-06-04T20:45:39.027688+00:00 GitLab Importer Affected by VCID-m5kp-t88v-fufu https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/node-red/CVE-2021-21298.yml 38.6.0
2026-06-04T20:26:42.787275+00:00 GitLab Importer Affected by VCID-gh2h-q3t6-ebeb https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/node-red/CVE-2019-15607.yml 38.6.0
2026-06-04T17:22:13.754545+00:00 GithubOSV Importer Fixing VCID-1y32-5wc9-4uhv https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-5g6j-8hv4-vfgj/GHSA-5g6j-8hv4-vfgj.json 38.6.0
2026-06-04T16:20:24.401491+00:00 GitLab Importer Fixing VCID-1y32-5wc9-4uhv https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/node-red/GMS-2020-752.yml 38.6.0