CVE-2019-10756

2019-10-0819:15:09

Google

osv.dev

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

24.8%

JSON

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default.

CPENameOperatorVersion
node-red-dashboardeq2.16.3
node-red-dashboardeq2.9.8
node-red-dashboardeq2.3.4
node-red-dashboardeq2.9.3
node-red-dashboardeq2.9.4
node-red-dashboardeq2.9.5
node-red-dashboardeq2.10.1
node-red-dashboardeq2.3.8
node-red-dashboardeq2.15.2
node-red-dashboardeq2.11.0

Name	Operator	Version
node-red-dashboard	eq	2.16.3
node-red-dashboard	eq	2.9.8
node-red-dashboard	eq	2.3.4
node-red-dashboard	eq	2.9.3
node-red-dashboard	eq	2.9.4
node-red-dashboard	eq	2.9.5
node-red-dashboard	eq	2.10.1
node-red-dashboard	eq	2.3.8
node-red-dashboard	eq	2.15.2
node-red-dashboard	eq	2.11.0