CVE-2026-71269

Name of the Vulnerable Software and Affected Versions Node-RED (affected versions not specified)

Description The local-filesystem library storage module contains a path traversal flaw in the getLibraryEntry() and saveLibraryEntry() functions. This issue occurs because the user-supplied path parameter is joined directly into the filesystem path via fspath.join(libDir, type, path) without sanitization, containment checks, or path normalization. The flaw is reachable via the GET and POST endpoints /library/:lib/:type/*path. An authenticated user can use ../ sequences to read arbitrary files outside the library directory. Users with write access can write arbitrary files, which may lead to remote code execution through cron injection or by modifying SSH authorized keys.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.