AIKIDO-2026-970261
@node-red/editor-api is vulnerable to Cross-Site Scripting (XSS)
59
Medium Risk
This Affects:
@node-red/editor-apiTL;DR
The Node-RED editor endpoint in @node-red/editor-api renders the admin editor page and embeds req.session.messages into an inline <script> block through the editor template. The session-message JSON is inserted without escaping, so content that reaches session messages can inject script into the editor page, potentially leading to arbitrary JavaScript execution in the Node-RED admin editor origin. The fix escapes <, >, &, and / in the serialized session messages before they are rendered into the script tag.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and untrusted content can reach the editor session messages.
Background info
@node-red/editor-api is vulnerable to Cross-Site Scripting (XSS) in versions 2.1.0 - 4.1.11 and 5.0.0 - 5.0.1.
How to fix this
Upgrade the @node-red/editor-api library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant