← Vulnerability feed

Vulnerability record · CVE-2022-3783 · published 31 October 2022

CVE-2022-3783: Nodered node-red-dashboard cross-site scripting vulnerability

Nodered · Node Red Dashboard

A vulnerability, which was classified as problematic, has been found in node-red-dashboard. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component ui_text Format Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 9305d1a82f19b235dfad24a7d1dd4ed244db7743. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-212555.

6.1 CVSS 3.1 Medium EPSS 0.64% · top 51.5% CWE-707 · CWE-707CWE-79 · Cross-site scripting
6.1CVSS 3.1 base score
0.64%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

A vulnerability, which was classified as problematic, has been found in node-red-dashboard. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component ui_text Format Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 9305d1a82f19b235dfad24a7d1dd4ed244db7743. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-212555.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/node-red/node-red-dashboard/commit/9305d1a82f19b235dfad24a7d1dd4ed244db7743 PatchThird Party Advisory
https://github.com/node-red/node-red-dashboard/issues/772 ExploitIssue TrackingThird Party Advisory
https://vuldb.com/?id.212555 Permissions RequiredThird Party AdvisoryVDB Entry
https://github.com/node-red/node-red-dashboard/commit/9305d1a82f19b235dfad24a7d1dd4ed244db7743 PatchThird Party Advisory
https://github.com/node-red/node-red-dashboard/issues/772 ExploitIssue TrackingThird Party Advisory
https://vuldb.com/?id.212555 Permissions RequiredThird Party AdvisoryVDB Entry

Track CVE-2022-3783 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2021-3223Nodered node-red-dashboard path traversal vulnerabilityNode-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files.EPSS 19%5.4CVE-2019-10756Nodered node-red-dashboard cross-site scripting vulnerabilityIt is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by …EPSS 0.57%7.0CVE-2025-26633Microsoft Management Console improper neutralization security feature bypassMicrosoft Management Console (MMC) fails to properly neutralize input, letting an attacker bypass a security feature. The flaw affects a broad set of…KEVEPSS 30%analysed7.8CVE-2024-43572Microsoft Management Console remote code execution flawCVE-2024-43572 is a remote code execution vulnerability in the Microsoft Management Console (MMC) affecting a broad range of Windows 10, Windows 11 a…KEVEPSS 67%analysed

Source: NIST National Vulnerability Database (record CVE-2022-3783), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.