{"id":"CVE-2022-3783","aliases":["EUVD-2022-7442","GHSA-vrv9-3x3w-ffxw"],"status":"published","title":"node-red-dashboard ui_text Format ui-component-ctrl.js cross site scripting","description":"A vulnerability, which was classified as problematic, has been found in node-red-dashboard. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component ui_text Format Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 9305d1a82f19b235dfad24a7d1dd4ed244db7743. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-212555.","severity":{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0083,"percentile":0.57857,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-707","CWE-79"],"published":"2022-10-31T00:00:00Z","modified":"2026-10-28T02:30:58Z","fixes":[{"ecosystem":"npm","package":"node-red-dashboard","fixed_in":["3.2.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"node-red-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0"}]}]},{"source":"osv","ecosystem":"npm","package":"node-red-dashboard","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.2.0"}]}]}],"products":[{"vendor":"nodered","product":"node-red-dashboard"},{"vendor":"unspecified","product":"node-red-dashboard"}],"references":[{"url":"https://github.com/node-red/node-red-dashboard/issues/772","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://github.com/node-red/node-red-dashboard/commit/9305d1a82f19b235dfad24a7d1dd4ed244db7743","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://vuldb.com/?id.212555","tags":["x_transferred","Permissions Required","Third Party Advisory","VDB Entry","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3783","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vrv9-3x3w-ffxw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3783.json","tags":["advisory"]},{"url":"https://github.com/node-red/node-red-dashboard","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-3783","title":"node-red-dashboard ui_text Format ui-component-ctrl.js cross site scripting","description":"A vulnerability, which was classified as problematic, has been found in node-red-dashboard. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component ui_text Format Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 9305d1a82f19b235dfad24a7d1dd4ed244db7743. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-212555.","status":"published","published":"2022-10-31T00:00:00Z","modified":"2025-04-15T13:23:12.687Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-707"],"updated_at":"2026-11-02T14:34:33.574107Z"}],"euvd":[{"id":"EUVD-2022-7442","description":"A vulnerability, which was classified as problematic, has been found in node-red-dashboard. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component ui_text Format Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 9305d1a82f19b235dfad24a7d1dd4ed244db7743. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-212555.","status":"published","published":"2022-10-31T00:00:00Z","modified":"2025-04-15T13:23:12Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T20:52:31.065409Z"}],"ghsa":[{"id":"GHSA-vrv9-3x3w-ffxw","title":"node-red-dashboard vulnerable to Cross-site Scripting","description":"node-red-dashboard contains a cross-site scripting vulnerability. This issue affects some unknown processing of the file `components/ui-component/ui-component-ctrl.js` of the component ui_text Format Handler. The attack may be initiated remotely. The issue is patched in version 3.2.0. ","status":"published","published":"2022-11-01T12:00:36Z","modified":"2023-02-01T05:04:20Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:32.120868Z"}],"nvd":[{"id":"CVE-2022-3783","description":"A vulnerability, which was classified as problematic, has been found in node-red-dashboard. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component ui_text Format Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 9305d1a82f19b235dfad24a7d1dd4ed244db7743. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-212555.","status":"published","published":"2022-10-31T21:15:12.413Z","modified":"2026-06-17T05:00:17.82Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-707","CWE-79"],"updated_at":"2026-11-02T14:07:31.127985Z"}],"osv":[{"id":"CVE-2022-3783","title":"node-red-dashboard ui_text Format ui-component-ctrl.js cross site scripting","description":"A vulnerability, which was classified as problematic, has been found in node-red-dashboard. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component ui_text Format Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 9305d1a82f19b235dfad24a7d1dd4ed244db7743. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-212555.","status":"published","published":"2022-10-31T00:00:00Z","modified":"2026-10-28T02:30:58.62369368Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-707"],"updated_at":"2026-11-02T15:44:26.53798Z"},{"id":"GHSA-vrv9-3x3w-ffxw","title":"node-red-dashboard vulnerable to Cross-site Scripting","description":"node-red-dashboard contains a cross-site scripting vulnerability. This issue affects some unknown processing of the file `components/ui-component/ui-component-ctrl.js` of the component ui_text Format Handler. The attack may be initiated remotely. The issue is patched in version 3.2.0. ","status":"published","published":"2022-11-01T12:00:36Z","modified":"2023-11-08T04:10:09.912407Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:57.694388Z"}]}}