CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NCVE-2021-21297
Medium (6.5) in nodered node-red. EPSS 1.4% chance of exploitation in the next 30 days. Fixed in @node-red/runtime 1.2.8.
Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default behaviour of the Node-RED runtime. The vulnerability is patched in the 1.2.8 release. A workaround is to ensure only authorized users are able to access the editor url.
Severity
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-1321, CWE-915
- Published
- Modified
- Record from
- the NVD, synced
Affected
- nodered:node-red
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xp9c-82x8-7f67 | npm | @node-red/runtime | <1.2.8 | 1.2.8 |