https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T02:06:57.133580+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-22162 EUVD-2026-22162 2026-10-07T02:06:57.336663+00:00 EUVD-2026-22162 https://cve.radiocsirt.org/vuln/fkie_cve-2021-21298 fkie_cve-2021-21298 2026-10-07T02:06:57.336700+00:00

Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via the Projects API. The issue has been patched in Node-RED 1.2.8. The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED. The primary workaround is not give untrusted users read access to the Node-RED editor.

 https://cve.radiocsirt.org/vuln/ghsa-m33v-338h-4v9f GHSA-m33v-338h-4v9f — Path traversal in Node-Red 2026-10-07T02:06:57.336737+00:00

Affected: npm: @node-red/runtime

### Impact

This vulnerability allows arbitrary path traversal via the Projects API.

If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via the Projects API.

### Patches

The issue has been patched in Node-RED 1.2.8

### Workarounds

The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED.

The primary workaround is not give untrusted users read access to the Node-RED editor.

### For more information If you have any questions or comments about this advisory: * Email us at [team@nodered.org](mailto:team@nodered.org)

### Acknowledgements

Thanks to the Tencent Woodpecker Security Team for disclosing this vulnerability.

 https://cve.radiocsirt.org/vuln/gsd-2021-21298 gsd-2021-21298 2026-10-07T02:06:57.336782+00:00 gsd-2021-21298