CVE-2021-21298 Path traversal in Node-Red
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2021-21298?
CVE-2021-21298 is a low-severity vulnerability in node-red, published on 26 Feb 2021.
Official description
Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via the Projects API. The issue has been patched in Node-RED 1.2.8. The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED. The primary workaround is not give untrusted users read access to the Node-RED editor.
Weakness: CWE-22
Which versions are affected by CVE-2021-21298?
2 open source packages ship an affected version, including @node-red/runtime. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@node-red/runtime npm | All versions | 1.2.8 |
@node-red/runtime npm | All versions | 1.2.8 |
Products include Nodered Node-Red.
How do I fix CVE-2021-21298?
Upgrade @node-red/runtime to 1.2.8 or later.
Is CVE-2021-21298 being exploited?
There is no known exploitation of CVE-2021-21298 in the wild and no public exploit code.
Other vulnerabilities in node-red
Sources
Also known as GHSA-m33v-338h-4v9f.