{"action":"Upgrade @node-red/runtime to 1.2.8 or later.","affected":[{"fixed":"1.2.8","introduced":"0"}],"component":"@node-red/runtime","cve_ids":["CVE-2021-21297"],"ecosystem":"npm","epss":0.01397,"exploited":false,"fixed_versions":["1.2.8"],"ghsa_id":"GHSA-xp9c-82x8-7f67","id":"tcs_01M5KGJFG9TSCVM3YCSXJ1T953","modified_at":"2026-07-08T06:28:13.960703229Z","published_at":"2021-02-26T16:31:05Z","references":["https://osv.dev/vulnerability/GHSA-xp9c-82x8-7f67","https://github.com/node-red/node-red/security/advisories/GHSA-xp9c-82x8-7f67","https://nvd.nist.gov/vuln/detail/CVE-2021-21297","https://github.com/node-red/node-red","https://github.com/node-red/node-red/releases/tag/1.2.8","https://www.npmjs.com/package/@node-red/editor-api","https://www.npmjs.com/package/@node-red/runtime"],"severity":{"label":"high","score":7.7},"sources":[{"source":"osv","source_id":"GHSA-xp9c-82x8-7f67","url":"https://osv.dev/vulnerability/GHSA-xp9c-82x8-7f67"}],"summary":"Prototype Pollution in Node-Red"}