GHSA-m33v-338h-4v9f

Suggest an improvement
Source
https://github.com/advisories/GHSA-m33v-338h-4v9f
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/02/GHSA-m33v-338h-4v9f/GHSA-m33v-338h-4v9f.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-m33v-338h-4v9f
Aliases
Related
Published
2021-02-26T16:31:23Z
Modified
2023-11-08T04:04:40.604117Z
Summary
Path traversal in Node-Red
Details

Impact

This vulnerability allows arbitrary path traversal via the Projects API.

If the Projects feature is enabled, a user with projects.read permission is able to access any file via the Projects API.

Patches

The issue has been patched in Node-RED 1.2.8

Workarounds

The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED.

The primary workaround is not give untrusted users read access to the Node-RED editor.

For more information

If you have any questions or comments about this advisory: * Email us at team@nodered.org

Acknowledgements

Thanks to the Tencent Woodpecker Security Team for disclosing this vulnerability.

Database specific 
{
    "nvd_published_at": "2021-02-26T17:15:00Z",
    "cwe_ids": [
        "CWE-22"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2021-02-26T16:23:34Z"
}
References

Affected packages

npm / @node-red/runtime

Package

Name
@node-red/runtime
View open source insights on deps.dev
Purl
pkg:npm/%40node-red/runtime

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.8