AIKIDO-2026-970261

TL;DR

The Node-RED editor endpoint in @node-red/editor-api renders the admin editor page and embeds req.session.messages into an inline <script> block through the editor template. The session-message JSON is inserted without escaping, so content that reaches session messages can inject script into the editor page, potentially leading to arbitrary JavaScript execution in the Node-RED admin editor origin. The fix escapes <, >, &, and / in the serialized session messages before they are rendered into the script tag.