Vulnerability Description
Node-RED's local-filesystem library storage module (getLibraryEntry() and saveLibraryEntry() in packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/library.js), reachable via GET/POST /library/:lib/:type/*path, joins the user-supplied path parameter directly into the filesystem path via fspath.join(libDir, type, path) with no traversal sanitization, containment check, or path normalization/prefix verification. An authenticated user (including read-only-scoped tokens for the read path) can supply a path containing `../` sequences to read arbitrary files outside the library directory; a user with write access can write arbitrary files, enabling remote code execution via SSH authorized_keys or cron injection. This is a distinct, separately unpatched traversal from the previously fixed CVE-2021-21298 (Projects API).
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/node-red/node-red
- https://github.com/node-red/node-red/blob/master/packages/node_modules/@node-red
FAQ
What is CVE-2026-71269?
CVE-2026-71269 is a vulnerability with a CVSS score of 7.2 (HIGH). Node-RED's local-filesystem library storage module (getLibraryEntry() and saveLibraryEntry() in packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/library.js), reachable via GET/POST ...
How severe is CVE-2026-71269?
CVE-2026-71269 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-71269?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.