Executive brief
Node-RED is a visual automation and integration platform used to build IoT and workflow applications. Versions prior to 0.18.6 contain a cross-site scripting vulnerability in the item name field that fails to properly sanitize user input, allowing an attacker to inject and execute arbitrary JavaScript code in the browsers of users viewing affected content.
Technical details
Node-RED versions prior to 0.18.6 contain a reflected or stored cross-site scripting (XSS) vulnerability in the item name field. The vulnerability exists because user-supplied input in the name field is not properly HTML-escaped or sanitized before being rendered in the web interface. An attacker can craft a malicious payload containing JavaScript code and inject it into the name field of a new item. When the victim's browser renders the page, the injected script executes in their security context, potentially allowing session hijacking, credential theft, or other malicious actions. The attack requires either the attacker to craft a request to a vulnerable instance or, if stored XSS, for a victim to view a page containing the injected payload. Patches are available in version 0.18.6 and later.
Affected products
- OpenJS Foundation node-red < 0.18.6
Timeline
- 2020-09-11: disclosed: Advisory published on GitHub
- 2020-09-11: patched: Patched in version 0.18.6