CVE-2019-10756

CVE-2019-10756 is a medium-severity cross-site scripting (XSS) vulnerability affecting Node-RED Dashboard versions prior to 2.17.0, where the ui_notification node improperly accepts raw HTML. This allows an authenticated attacker to inject malicious JavaScript, potentially leading to client-side data compromise or manipulation. While the attack complexity is low, it requires user interaction and a network vector, with a CVSS score of 5.4. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this vulnerability.