Description
It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default.
Remediation
References
https://snyk.io/vuln/SNYK-JS-NODEREDDASHBOARD-471939
Related Vulnerabilities
CVE-2022-41404 Vulnerability in maven package org.ini4j:ini4j
CVE-2021-27850 Vulnerability in maven package org.apache.tapestry:tapestry-core
CVE-2023-27564 Vulnerability in npm package n8n
CVE-2023-27087 Vulnerability in maven package com.xuxueli:xxl-job
CVE-2021-40660 Vulnerability in maven package org.javadelight:delight-nashorn-sandbox