CyberRota Analysis
AI-GeneratedThe local-filesystem library storage module in Node-RED is vulnerable to directory traversal attacks due to improper handling of user-supplied path parameters, allowing authenticated users to read arbitrary files outside the designated library directory. This vulnerability can lead to significant security risks, including remote code execution for users with write access, as they can manipulate sensitive files like SSH authorized_keys or cron jobs. Organizations using Node-RED, especially those with user authentication mechanisms, should prioritize patching this vulnerability to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Node-RED's local-filesystem library storage module (getLibraryEntry and saveLibraryEntry in packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/library.js), reachable via GET/POST /library/:lib/:type/*path, joins the user-supplied path parameter directly into the filesystem path via fspath.join(libDir, type, path) with no traversal sanitization, containment check, or path normalization/prefix verification.