https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 22:02:35 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-22162 EUVD-2026-22162 https://cve.radiocsirt.org/vuln/euvd-2026-22162 https://cve.radiocsirt.org/vuln/fkie_cve-2021-21298 <p>Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via the Projects API. The issue has been patched in Node-RED 1.2.8. The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED. The primary workaround is not give untrusted users read access to the Node-RED editor.</p> <p>Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via the Projects API. The issue has been patched in Node-RED 1.2.8. The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED. The primary workaround is not give untrusted users read access to the Node-RED editor.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-21298 https://cve.radiocsirt.org/vuln/ghsa-m33v-338h-4v9f <p><strong>Affected:</strong> npm: @node-red/runtime</p> <p>### Impact</p> <p>This vulnerability allows arbitrary path traversal via the Projects API.</p> <p>If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via the Projects API.</p> <p>### Patches</p> <p>The issue has been patched in Node-RED 1.2.8</p> <p>### Workarounds</p> <p>The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED.</p> <p>The primary workaround is not give untrusted users read access to the Node-RED editor.</p> <p>### For more information If you have any questions or comments about this advisory: * Email us at [team@nodered.org](mailto:team@nodered.org)</p> <p>### Acknowledgements</p> <p>Thanks to the Tencent Woodpecker Security Team for disclosing this vulnerability.</p> <p><strong>Affected:</strong> npm: @node-red/runtime</p> <p>### Impact</p> <p>This vulnerability allows arbitrary path traversal via the Projects API.</p> <p>If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via the Projects API.</p> <p>### Patches</p> <p>The issue has been patched in Node-RED 1.2.8</p> <p>### Workarounds</p> <p>The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED.</p> <p>The primary workaround is not give untrusted users read access to the Node-RED editor.</p> <p>### For more information If you have any questions or comments about this advisory: * Email us at [team@nodered.org](mailto:team@nodered.org)</p> <p>### Acknowledgements</p> <p>Thanks to the Tencent Woodpecker Security Team for disclosing this vulnerability.</p> https://cve.radiocsirt.org/vuln/ghsa-m33v-338h-4v9f https://cve.radiocsirt.org/vuln/gsd-2021-21298 gsd-2021-21298 https://cve.radiocsirt.org/vuln/gsd-2021-21298