What is GHSA-8w65-xjc5-9w79?

GHSA-8w65-xjc5-9w79 is a security advisory published by GitHub Security Advisories with Medium severity. Cross-Site Scripting in node-red

Which CVE IDs does GHSA-8w65-xjc5-9w79 cover?

GHSA-8w65-xjc5-9w79 covers the following CVE IDs: CVE-2019-15607. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8w65-xjc5-9w79?

GHSA-8w65-xjc5-9w79 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-8w65-xjc5-9w79?

GHSA-8w65-xjc5-9w79 affects 1 product, including: npm/node-red:\u003c= 0.20.7.

GHSA-8w65-xjc5-9w79MediumCVSS 5.4

Cross-Site Scripting in node-red

Vendor

GitHub Security Advisories

Published

January 30, 2020

Last Modified

September 11, 2023

🔗 CVE IDs covered (1)

CVE-2019-15607 →

📋 Description

Versions of node-red prior to 0.20.8are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize the name field in new Flows, allowing attackers to execute arbitrary JavaScript in the victim's browser.

Recommendation

Upgrade to version 0.18.6 or later.

🎯 Affected products1

npm/node-red:<= 0.20.7

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2019-15607
https://hackerone.com/reports/681986
https://www.npmjs.com/advisories/1456
https://github.com/advisories/GHSA-8w65-xjc5-9w79