The local-filesystem library storage module in Node-RED (specifically getLibraryEntry() and saveLibraryEntry() in packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/library.js) improperly joins user-supplied path parameters directly into filesystem paths without sanitization or containment checks. This allows authenticated users, including those with read-only tokens, to perform directory traversal attacks by using '../' sequences in the path parameter to read arbitrary files outside the library directory. Users with write permissions can write arbitrary files, potentially enabling remote code execution via mechanisms such as SSH authorized_keys or cron injection. This vulnerability is separate and distinct from the previously fixed CVE-2021-21298 affecting the Projects API. No patch or remediation is currently documented.

An attacker with authenticated access can read arbitrary files outside the intended library directory, potentially exposing sensitive information. If the attacker has write permissions, they can write arbitrary files to the filesystem, which may lead to remote code execution through common attack vectors like SSH authorized_keys or cron jobs. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users only and limit write permissions to the library storage module. Monitor for updates from Node-RED regarding an official fix.