Cross-site Scripting in node-red-dashboard

Description

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default.

Recommendation

Update the node-red-dashboard package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.17.0
• Patched version(s): 2.17.0

References

• GHSA-xg59-m7wx-853q
• snyk.io
• CVE-2019-10756
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• node-red-dashboard vulnerable to Cross-site Scripting - CVE-2022-3783
• Cross-site Scripting in pandao editor.md - CVE-2019-14517
• Cross-site Scripting in pandao - CVE-2019-14653
• Cross-Site Scripting in @nuxt/devalue - CVE-2019-13506

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

node-red-dashboard