@node-red/runtime

@node-red/runtime ====================

Latest 5.0.8

82%

Total Score

healthy

Active, well-backed project with regular releases, but its release workflow has insecure commands and no pinned action references.

Are you affected? Scan for Free

Health Score Breakdown

Repo package mention

The linked repository name does not match this subpackage and its README does not name it, which weakens package-to-repository transparency. The package README does identify the repository as the Node-RED monorepo, partly compensating for that gap.

Workflow audit

Both workflows were analyzed and use read-only permissions, with no untrusted checkouts or script injection. However, the high-confidence insecure-commands finding and all 8 action references being unpinned are release-workflow hygiene risks; the low-confidence cache finding adds little weight.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2024-10049 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @node-red/runtime is vulnerable to Use of Weak Hash in versions 0.2.0 - 3.1.5.	0.2.0 - 3.1.5	Low
CVE-2021-21298 @node-red/runtime is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 1.2.8.	0.0.0 - 1.2.8	Low
CVE-2021-21297 @node-red/runtime is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in versions 0.0.0 - 1.2.8.	0.0.0 - 1.2.8	High