medium5.4
CVE-2019-10756
Cross-site Scripting in node-red-dashboard
Impact
It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | node-red-dashboard | < 2.17.0 | 2.17.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nodered | Node-Red-Dashboard | before 2.17.0 |