CVE-2026-71269 node-red CVE debrief

Who should care

Node-RED users and administrators, especially those with exposed or internet-facing installations, should prioritize patching and mitigation efforts. Ensure that all users with library access are authenticated and have appropriate permissions. Review system logs for suspicious activity and monitor for unauthorized file access attempts.

Technical summary

Node-RED's local-filesystem library storage module is vulnerable to path traversal attacks. An authenticated user can supply a path containing `../` sequences to read arbitrary files outside the library directory. Users with write access can write arbitrary files, enabling remote code execution via SSH authorized_keys or cron injection. This vulnerability is distinct from CVE-2021-21298 and affects the packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/library.js file.

Defensive priority

Authenticated users with library write access can achieve remote code execution; prioritize containment and mitigation.

Recommended defensive actions

• Verify and apply vendor patches or updates
• Restrict access to library directories and sensitive files
• Implement additional monitoring and logging for suspicious activity
• Conduct thorough inventory checks for affected systems
• Consider compensating controls for unpatched systems
• Review SSH authorized_keys and cron jobs for unauthorized changes
• Monitor system logs for unusual file access patterns

Evidence notes

Evidence is limited; verify affected scope and vendor remediation status. Conduct thorough inventory checks and monitor for suspicious activity. Ensure Node-RED installations are reviewed for exposure, especially if internet-facing. Verify library directory access controls and user authentication mechanisms.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.