GHSA-5g6j-8hv4-vfgj
Cross-Site Scripting in node-red
GHSA-5g6j-8hv4-vfgj is a vulnerability with no CVSS score yet in node-red, published September 11, 2020. No source lists public exploit code. Fixed in node-red 0.18.6.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.18.6node-red
Description
Versions of node-red prior to 0.18.6 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize the name field in new items, allowing attackers to execute arbitrary JavaScript in the victim's browser.
Recommendation
Upgrade to version 0.18.6 or later.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
node-rednpm | before 0.18.6 | 0.18.6 |
What each source reports
GitHub AdvisoriesNo score
Cross-Site Scripting in node-red
Versions of node-red prior to 0.18.6 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize the name field in new items, allowing attackers to execute arbitrary JavaScript in the victim's browser.
Recommendation
Upgrade to version 0.18.6 or later.
- Record
GHSA-5g6j-8hv4-vfgj- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Cross-Site Scripting in node-red
Versions of node-red prior to 0.18.6 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize the name field in new items, allowing attackers to execute arbitrary JavaScript in the victim's browser.
Recommendation
Upgrade to version 0.18.6 or later.
- Record
GHSA-5g6j-8hv4-vfgj- Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.