MEDIUM5.4

GHSA-xg59-m7wx-853q

Cross-site Scripting in node-red-dashboard

Quick fix

GHSA-xg59-m7wx-853q — node-red-dashboard: upgrade to the fixed version with the command below.

npm install node-red-dashboard@2.17.0

Details

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/node-red-dashboard

Introduced in: 0Fixed in: 2.17.0

Fixnpm install node-red-dashboard@2.17.0

References

https://nvd.nist.gov/vuln/detail/CVE-2019-10756[ADVISORY]
https://snyk.io/vuln/SNYK-JS-NODEREDDASHBOARD-471939[WEB]