{"action":"Upgrade @node-red/runtime to 1.2.8 or later.","affected":[{"fixed":"1.2.8","introduced":"0"}],"component":"@node-red/runtime","cve_ids":["CVE-2021-21298"],"ecosystem":"npm","epss":0.0108,"exploited":false,"fixed_versions":["1.2.8"],"ghsa_id":"GHSA-m33v-338h-4v9f","id":"tcs_01M5KFZDP1NW029Z4MJVNWBT04","modified_at":"2026-07-08T06:28:45.954945204Z","published_at":"2021-02-26T16:31:23Z","references":["https://osv.dev/vulnerability/GHSA-m33v-338h-4v9f","https://github.com/node-red/node-red/security/advisories/GHSA-m33v-338h-4v9f","https://nvd.nist.gov/vuln/detail/CVE-2021-21298","https://github.com/node-red/node-red/commit/74db3e17d075f23d9c95d7871586cf461524c456","https://github.com/node-red/node-red/releases/tag/1.2.8","https://www.npmjs.com/package/@node-red/runtime"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-m33v-338h-4v9f","url":"https://osv.dev/vulnerability/GHSA-m33v-338h-4v9f"}],"summary":"Path traversal in Node-Red"}