N8n
Monthly
Code injection in n8n's legacy expression engine allows an authenticated user to replace the mutable global JSON.stringify function within expression evaluation, causing subsequent code-generation paths to embed and execute attacker-controlled JavaScript. Affected are all n8n versions prior to 1.123.76 (v1 branch), 2.37.7, and 2.38.2. The vulnerability is confined to the legacy expression engine (isolated-vm-bridge.ts and ExpressionBuilder.ts); the vm expression engine is unaffected. No public exploit or CISA KEV listing has been identified at time of analysis.
Credential exfiltration in n8n's OpenAI Chat Model node allows an authenticated workflow editor to redirect the model-search dropdown request - including the attached OpenAI API key - to an arbitrary attacker-controlled host by overriding `options.baseURL`. Affected versions span the v1 branch prior to 1.123.76 and the v2 branch prior to 2.37.7 and 2.38.2; the root cause is the omission of `assertOpenAiCredentialAllowsUrl` in `loadModels.ts`, the same domain-restriction guard applied elsewhere in the node. No active exploitation or public exploit code has been identified at time of analysis; vendor-released patches are available across all three branches.
Remote code execution in n8n workflow automation platform prior to versions 1.123.76, 2.37.7, and 2.38.2 is achievable by any authenticated user who can author workflow expressions. The root cause is a sandbox escape in the PrototypeSanitizer AST hook: because the sanitizer references itself via dynamically scoped `this`, a crafted class field named `__sanitize` rebinds the sanitizer function, after which the expression freely invokes the JavaScript `Function()` constructor and executes arbitrary Node.js code on the backend. No public exploit has been identified at time of analysis, but the Function constructor escape technique is well-documented in the JavaScript security research community, lowering the barrier to independent rediscovery.
Unvalidated input sizes on the OAuth Dynamic Client Registration endpoint in n8n allow unauthenticated remote attackers to exhaust database storage by repeatedly submitting oversized client_name and grant_types values. Affected versions are all n8n releases prior to 2.37.7 (in the 2.37.x branch) and prior to 2.38.2 (in the 2.38.x branch). Because the endpoint is publicly accessible without authentication and the attack is trivially automatable, a single attacker can render the n8n instance unavailable by filling database disk capacity, taking down all workflow automation for any organization relying on the platform.
Credential exposure in n8n's Strapi, SeaTable, and Mailcheck integration nodes causes plaintext API secrets to persist in execution error logs, readable by any authenticated user via the REST API. The three affected nodes pass decrypted credentials to external authentication endpoints through a legacy HTTP helper that lacks error-handling wrappers; when those calls fail, the raw secret is written into execution error records rather than being suppressed or redacted. This bypasses n8n's credential API blank-value redaction, effectively leaking third-party service credentials to any n8n user who can inspect execution results. No public exploit or CISA KEV listing exists at time of analysis; patches are available in versions 1.123.73, 2.35.4, and 2.36.2.
Local file read and server-side request forgery (SSRF) in n8n's Gmail (v1) and Brevo workflow nodes allow an authenticated low-privilege user to exfiltrate files accessible to the n8n process or probe internal network endpoints by supplying a crafted expression that resolves to a JavaScript object with a `path` or `href` property. Affected versions span the stable branch before 1.123.73 and the 2.x branch before 2.35.4 and 2.36.2, as confirmed by vendor advisory GHSA-95ph-833c-4wrp. No public exploit has been identified at time of analysis, but the attack mechanism is well-defined and low-complexity for any user with workflow creation rights.
Prototype chain sandbox escape in n8n's $fromAI expression handler allows any user holding workflow-build privilege to achieve remote code execution within the main n8n server process. The $fromAI handler failed to restrict placeholder key lookup to own properties and permitted reserved prototype keys; when the input value is a primitive, the handler returns a live reference to the host-prototype chain, enabling traversal to Function.prototype.constructor and compilation of arbitrary JavaScript outside the expression sandbox. All n8n deployments running versions below 1.123.73 (v1 track), 2.35.4, or 2.36.2 (v2 track) are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the technique (prototype chain walk to Function constructor) is well-understood and reliable once sandbox access is obtained.
Remote code execution in n8n's Git node allows an authenticated workflow user to execute arbitrary OS commands as the n8n process user by pointing the node at a repository containing malicious git configuration. The vulnerability arises from an incomplete sanitization list that omitted the content-filter and merge-driver git configuration key families, allowing those keys to survive into git operations and trigger arbitrary command execution during routine Add, Commit, Checkout, or Pull operations. Patched versions 1.123.73, 2.35.4, and 2.36.2 are confirmed available; no public exploit or CISA KEV listing has been identified at time of analysis.
Credential exfiltration in n8n's workflow execution engine allows a low-privileged authenticated user to reference another user's credentials inside an inline sub-workflow node (such as the Workflow Tool node) without any ownership validation. Affected versions are n8n before 2.35.4 and 2.36.x before 2.36.2. When a privileged execution context later runs the poisoned workflow and resolves the referenced secret, the sub-workflow can forward the plaintext credential to an attacker-controlled endpoint. No public exploit code has been identified at time of analysis, but the VulnCheck advisory corroborates the GitHub Security Advisory GHSA-4r56-g65c-fm83.
Expression sandbox bypass in n8n before 2.36.2 allows authenticated workflow editors to escape the sandboxed evaluation environment by placing free identifiers in spread, computed-key, switch-case, or class-extension positions, which resolve against Node.js process globals instead of the restricted sandbox scope. Exploiting this flaw enables mutation of host objects - including prototype chains or environment-level state - with those changes persisting process-wide until the n8n service is restarted, affecting all concurrent workflows and users on the same instance. No public exploit or CISA KEV listing has been identified at time of analysis; patch version 2.36.2 is confirmed via the GitHub Security Advisory.
Code execution in n8n's Git node (all 1.x releases before 1.123.69, all 2.x releases before 2.33.4 and 2.34.1) allows an authenticated attacker who can also plant files on the n8n host to run arbitrary OS commands as the n8n process user. The Git node passes repository-local git configuration values directly to execution without neutralization, satisfying CWE-78 (OS Command Injection); triggering any Git node operation against a repository whose config has been poisoned fires the injected command automatically. No public exploit has been identified at time of analysis, but the high impact triad (VC:H/VI:H/VA:H) and confirmed patch availability make immediate upgrading the correct response.
Arbitrary file read and write in n8n's Snowflake node allows an authenticated low-privileged user to exfiltrate or overwrite files on the n8n host by injecting Snowflake client-side commands (PUT/GET) into the Execute Query input field, bypassing n8n's own file-access restrictions. Affected versions span n8n before 1.123.69, all 2.x builds before 2.33.4, and 2.34.x before 2.34.1, as confirmed by vendor advisory GHSA-r4j2-j3wm-q689. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and the low barrier to exploitation - requiring only n8n credentials plus access to a Snowflake connection - make this a high-priority remediation.
Privilege escalation in n8n's custom project role management allows users holding only the narrow `role:manageProject` global scope to seize full administrative control over arbitrary projects across the entire instance. The root cause is a missing project-level authorization check in the role deletion-with-reassignment code path: the API validates only that the reassignment target role exists and is project-scoped, never verifying that the requesting user has any rights over the affected projects or their members. No public exploit has been identified and no CISA KEV listing exists at time of analysis; patches are confirmed available in versions 2.33.4 and 2.34.1.
Prototype pollution in n8n's JavaScript task runner sandbox allows an authenticated user with Code node access to escape VM isolation and execute arbitrary OS commands within the runner container. Affected versions span the v1.x branch before 1.123.69 and the v2.x branch before 2.33.4 and 2.34.1. The corruption is process-wide, meaning a single malicious execution can poison the prototype chain for all subsequent tenant Code node runs on the same shared runner; on v1.x instances without task runner isolation, the attack surface escalates to the main n8n process itself. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE.
Decrypted credential secrets are exposed in execution logs in n8n workflow automation software across versions before 1.123.69, 2.33.4, and 2.34.1. The GraphQL node fails to wrap connection-level HTTP client errors in n8n's standard error type, propagating raw error objects - which carry decrypted credential headers - directly into the persistent execution record. Any authenticated user with read access to workflow execution history can recover those plaintext secrets. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the low-privilege access requirement and direct credential exposure make this a high-priority remediation target for shared or multi-tenant deployments.
Expression injection in n8n's workflow editor allows an authenticated member to store a malicious payload in a resource-locator field that executes as JavaScript in any other user's browser session when they open the affected node. The root cause is that the editor splices the field's stored value directly into the node type's URL template without sanitizing expression syntax, enabling cross-user script execution within authenticated sessions. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.4 reflects high confidentiality and integrity impact on the vulnerable system.
Stored XSS in n8n's Form node completion page allows a low-privileged authenticated workspace member to bypass the origin's Content-Security-Policy and deliver arbitrary scripts to public form submitters. The flaw stems from a conditional CSP application gap: sandboxing was only enforced when `respondWith` was not set to 'redirect', yet `responseText` was rendered as raw HTML regardless of that setting. Scripts injected this way execute same-origin with the victim's n8n session, enabling session token theft, credential harvesting, or unauthorized actions. No public exploit code or CISA KEV listing has been identified at time of analysis.
PostgREST filter injection in n8n's Supabase integration node exposes any connected Supabase database to full-table disclosure, deletion, or modification across versions before 1.123.69, 2.33.4, and 2.34.1. The Row Get Many, Delete, and Update operations concatenate expression-bindable values into filter queries without sanitization, allowing an attacker who can supply input to a workflow to widen a scoped filter into an unfiltered full-table operation. No public exploit identified at time of analysis, but the CVSS 4.0 subsequent-system impact is rated high across confidentiality, integrity, and availability, reflecting the catastrophic downstream database risk.
NoSQL injection in n8n's MongoDB integration node (Find, Delete, and Aggregate operations) allows an attacker who can supply externally-controlled data into a workflow query to inject MongoDB operators such as $ne or $where, transforming an intended single-document lookup into full-collection disclosure, mass deletion, or arbitrary database operations. Versions prior to 1.123.69 (v1 branch) and 2.33.4 / 2.34.1 (v2 branch) are affected, per vendor advisory GHSA-953p-jm2c-8h5j. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 subsequent-system impact is rated High across confidentiality, integrity, and availability.
Remote code execution in n8n workflow automation platform (versions before 2.33.4 and 2.34.x before 2.34.1) arises from a path traversal flaw in the @n8n/workflow-sdk MCP node-schema loader. An authenticated user holding global:member privileges can supply a crafted node type string containing path-traversal sequences, causing the loader to resolve and execute an arbitrary file on the server filesystem as a Node.js module within the n8n main process. No public exploit has been identified at time of analysis and the vulnerability is not in the CISA KEV catalog, but the low privilege requirement and straightforward exploitability make this a high-priority patch for all self-hosted n8n deployments.
Remote code execution in n8n workflow automation platform (all versions prior to 1.123.64, 2.29.8, and 2.30.1) stems from a TOCTOU race condition in the Git node's clone operation, allowing any low-privileged authenticated user to achieve arbitrary JavaScript execution on the server. The attacker wins a race between path validation and the actual clone, replacing a legitimate directory with a symlink to plant a crafted repository in n8n's community node directory - which the platform loads and executes as trusted JavaScript on the next restart. Both self-hosted and cloud-hosted n8n instances are affected wherever authenticated users can create and run workflows containing the Git node; no public exploit or CISA KEV listing has been identified at time of analysis.
Credential authorization bypass in n8n's HTTP Request node allows an authenticated member with edit access to a shared workflow to silently exfiltrate or use another user's credential by setting the credential type field via a dynamic expression. The pre-execution permission check evaluates the unresolved expression string rather than its runtime-resolved value, causing the ownership check to be skipped entirely while the actual credential is loaded at execution time. Versions 1.123.67, 2.31.5, and 2.32.1 contain the fix; no public exploit has been identified at time of analysis.
Account takeover in n8n before 2.32.1 (and before 2.31.5 in the prior release line) is enabled by two simultaneous omissions in the Token Exchange Embed Login feature: the platform accepts an incoming JWT's email claim without confirming the issuer has cryptographically verified that address, and it does not enforce the trusted key's configured role ceiling against the matched local account. An attacker able to obtain any validly-signed token from a configured trusted issuer - including issuers that routinely emit unverified email addresses as part of their standard flows - can present that token with a victim user's email and be granted a fully authenticated n8n session with complete account control. No public exploit has been identified at time of analysis; however, the vulnerability is exploitable in straightforward steps once both deployment preconditions are satisfied.
Credential exfiltration in n8n's AI and LLM workflow nodes allows low-privileged users with use-only access to shared credentials to bypass the 'Allowed HTTP Request Domains' allowlist and redirect credential secrets to attacker-controlled infrastructure. Affected are all n8n npm installations before version 2.31.5 and the 2.32.0 release (fixed in 2.32.1), where at least one credential has domain restrictions configured and is shared with non-owner users. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the attack is low-complexity for any insider or compromised low-privilege account.
Path traversal in n8n's Git node before versions 1.123.67, 2.31.5, and 2.32.1 allows authenticated low-privilege users to escape the repository sandbox during fetch, pull, and push-tags operations. By pointing an allowlisted remote configuration value at a local filesystem path outside the intended sandbox, an attacker with workflow create/execute rights can pull arbitrary local git repositories into the workspace and read their files and full commit history, including any secrets or credentials stored in git history. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low complexity and low-privilege attack path make it a realistic insider or compromised-account threat in multi-user n8n deployments.
Remote code execution in n8n's Git node allows authenticated users with workflow creation and execution rights to run arbitrary OS commands as the n8n process user by staging a crafted repository that triggers git hook execution under default git security settings. All 1.x versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 are affected across both self-hosted and cloud deployments. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity attack path and broad version coverage make this a high-priority patch for any deployment permitting untrusted authenticated users.
Type confusion in the Send Email node of the n8n workflow automation platform allows an attacker-supplied non-string expression value to pass uncoerced into Nodemailer, which then interprets it as a file path or URL rather than literal email content - enabling arbitrary local file disclosure and server-side request forgery (SSRF). Affected are n8n versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1, as confirmed by GitHub Security Advisory GHSA-2x35-3fw4-9jr4. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; exploitation depends on a specific non-default workflow configuration that requires an unauthenticated webhook, pre-configured SMTP credentials, and direct mapping of untrusted input into the email body field.
Expression sandbox escape in n8n's workflow engine allows any authenticated user with workflow creation or modification permissions to execute arbitrary operating system commands on the host running n8n. The flaw, classified as CWE-94 code injection, affects all npm releases of n8n-io/n8n prior to version 2.31.5 and all 2.32.x releases prior to 2.32.1. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and the full confidentiality, integrity, and availability impact ratings reflect a genuine high-severity remote code execution primitive for any n8n deployment where workflow editing rights are not tightly controlled.
Credential exfiltration in n8n's workflow automation platform allows any user with Editor access to a shared workflow to bypass authorization checks and use or exfiltrate credentials they are not permitted to access. The flaw exists because n8n validates credential permissions only for a node's top-level credential references, not for credentials embedded inside an Execute Sub-workflow node's inline workflow JSON (Source = Parameter); the embedded reference passes both save-time and runtime validation and resolves using the parent workflow's project context. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 7.2 reflects a credible, low-complexity path to high-confidentiality impact when workflow sharing is in use.
Arbitrary file write in n8n's Edit Image node allows authenticated workflow users to escape the node's designated working directory by injecting unsanitized format parameter values into the underlying image library. All n8n releases before 1.123.67 on the 1.x line, before 2.31.5 on the 2.x line, and before 2.32.1 on the 2.32.x line are affected, as confirmed by the GHSA-xmc9-4f2h-jf9c advisory from the n8n maintainers. No public exploit code has been identified at time of analysis, but patched versions and a remediation commit are available, and no special attacker position beyond workflow execution privileges is required.
Prototype pollution in n8n's Edit Fields (Set) node allows any authenticated user with workflow execution permissions to corrupt a shared global in the main Node.js process, triggering an instance-wide denial of service that locks out all users until a manual process restart. Affected are all n8n releases before 1.123.67, 2.31.5, and 2.32.1 across the 1.x and 2.x branches. The attack requires only a low-privilege authenticated account and no special configuration, making this a high operational priority for any multi-user or shared n8n deployment; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Server-side remote code execution in n8n workflow automation (self-hosted and cloud) before 1.123.64, 2.29.8, and 2.30.1 lets authenticated users abuse a TOCTOU race in the Git node's clone operation to write a malicious repository into the community node directory, which n8n auto-loads and executes on the next restart. The flaw bypasses path validation by swapping a validated directory for a symlink before the clone runs, turning a low-privilege account into arbitrary JavaScript execution on the host. No public exploit identified at time of analysis; reported by VulnCheck.
DOM-based cross-site scripting in n8n's HTML preview lets an authenticated global:member user execute JavaScript in the editor's same origin when a victim opens the preview. Because execution output is rendered into an iframe srcdoc without the sandbox attribute and a sanitizer bypass defeats the filtering, injected script runs same-origin and can invoke authenticated APIs using the victim's session, enabling account and workflow takeover. No public exploit identified at time of analysis; the flaw was reported by VulnCheck and is fixed in n8n 1.123.64, 2.29.8, and 2.30.1.
Privilege escalation and potential remote code execution affects n8n workflow-automation instances before 2.30.1 and 2.29.8 where both the Token Exchange module and Public API are enabled. Because JWTs issued via Token Exchange are granted the full set of Public API key scopes irrespective of the acting user's role, a low-privileged user holding a valid external JWT trusted by a configured issuer can invoke administrator-only operations - creating, deleting, or escalating users, and, where unverified Community Package installation is permitted, executing arbitrary code. No public exploit identified at time of analysis; VulnCheck-reported with a CVSS 4.0 base of 8.9.
Stored DOM cross-site scripting in n8n's Resource Locator component allows a low-privileged workflow author to execute arbitrary JavaScript in another user's browser session. The flaw stems from the workflow-persisted cachedResultUrl value being passed to window.open() without scheme validation, letting a javascript: URI fire when a victim opens the crafted workflow and clicks an external link. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but exploitation is realistic in shared/multi-tenant n8n instances.
Host-level remote code execution in n8n (n8n-io) occurs when an authenticated user with workflow create or modify permissions crafts a malicious expression that bypasses the sanitizer in the legacy expression evaluator's computed-member handler, executing arbitrary code as the n8n process. Because the legacy expression engine is the default in affected versions, standard deployments are exposed without any special configuration. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and carries a high CVSS 4.0 base score of 8.9.
Privilege escalation in n8n Enterprise SSO (versions before 1.123.64, 2.29.8, and 2.30.1) lets an SSO-authenticated user who controls their IdP-asserted instance-role claim be provisioned directly as global:owner, seizing full administrative control of workflows, credentials, users, and instance configuration. The instance-role provisioning path fails to block the owner role that the parallel token-exchange path explicitly rejects. Reported by VulnCheck with no public exploit identified at time of analysis; exploitation depends on a non-default configuration.
Privilege escalation in n8n workflow automation platform before 2.30.1 allows a low-privileged Project Viewer to abuse the AI Agents feature, where the node-execution (run-node) tool omits authorization checks. By chatting with an agent that has node tools enabled, the viewer can execute arbitrary nodes and read credential secrets they should not access. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Credential disclosure in n8n workflow automation (versions prior to 1.123.61, 2.27.4, and 2.28.1) allows an authenticated member holding use-only editor access to a shared workflow to read credential-populated HTTP headers via the $request object inside an HTTP Request node's pagination expression, then exfiltrate the secret through returned item data. This defeats n8n's credential-hiding model, which is supposed to prevent low-privilege collaborators from seeing the underlying secret values. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the EPSS/POC signals were not provided.
Privilege escalation via prototype pollution in n8n workflow automation lets an authenticated low-privilege user (holding the default workflow:create permission) corrupt Object.prototype through a crafted workflow saved, updated, or imported via the workflow API. Once polluted, subsequent unauthenticated requests are evaluated as a privileged user, exposing internal user and project listing endpoints. This is an information-disclosure and access-control flaw with no public exploit identified at time of analysis; CVSS 4.0 base score is 7.1.
Authentication bypass in n8n's external identity resolution lets an attacker impersonate other users when the instance trusts more than one token-exchange issuer. Affecting n8n before 2.27.4 and version 2.28.0, the flaw stems from resolving federated identities using only the JWT sub claim while ignoring the iss claim, so a valid token from one trusted issuer whose sub matches a victim registered under a different issuer grants full access to that victim's account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the authentication-level impact (VC:H/VI:H) makes it a meaningful account-takeover risk for multi-issuer SSO deployments.
Credential secret exfiltration in n8n (self-hosted workflow automation) prior to 2.27.4 and 2.28.1 lets a low-privilege member with use-only access to a shared credential leak that secret to an attacker-controlled server. The AI Agents feature fails to enforce the 'Allowed HTTP Request Domains' restriction when an MCP tool is aimed at an arbitrary URL, so the guardrail meant to keep secrets in-bounds is bypassed. No public exploit identified at time of analysis; risk is elevated because the abuse comes from an already-authorized internal user rather than an outside attacker.
Authenticated users in n8n versions prior to 1.123.23 and 2.6.4 can bypass external secrets permission checks to retrieve plaintext secret values from configured vaults by referencing secrets by name in credentials, even without list permissions. This allows unauthorized access to sensitive vault-stored credentials without requiring admin or owner privileges, provided the attacker knows or can guess the target secret name. Public exploit code exists for this vulnerability.
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute arbitrary SQL queries against PostgreSQL backends, enabling data modification and deletion. Public exploit code exists for this vulnerability. Affected versions prior to 1.123.26, 2.13.3, and 2.14.1 should be upgraded immediately, or workflow creation/editing permissions should be restricted to trusted users only.
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenticated users with workflow creation or modification permissions to achieve remote code execution. Versions prior to 2.14.1, 2.13.3, and 1.123.27 are affected. The CVSS score of 9.4 (Critical) reflects network-based exploitation with low complexity requiring only low-level authentication, though no current KEV listing or public POC availability is indicated in the provided intelligence.
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP email attribute to match a target account's email address, gaining full access that persists even after reverting the email change. This authentication bypass (CWE-287) affects n8n versions prior to 2.4.0 and 1.121.0 where LDAP is configured, and public exploit code exists. The vulnerability requires LDAP to be actively enabled and the attacker to control their own LDAP email attribute, creating a critical account takeover risk for administrators.
n8n workflow automation platform Community Edition contains an authorization bypass vulnerability allowing authenticated users with member-level privileges to steal plaintext credentials from other users. The flaw chains name-based credential resolution that doesn't enforce ownership with a permissions bypass affecting generic HTTP credential types (httpBasicAuth, httpHeaderAuth, httpQueryAuth). Attackers can decrypt and exfiltrate credentials without authorization, though native integration credentials remain unaffected.
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit the Merge node's 'Combine by SQL' mode to read arbitrary local files on the n8n host and achieve remote code execution. n8n versions prior to 2.14.1, 2.13.3, and 1.123.26 are affected. The vulnerability carries a CVSS 4.0 score of 9.4 (Critical) due to insufficient sandbox restrictions in the AlaSQL component, allowing SQL injection-style attacks against the host system. No public proof-of-concept or active exploitation (KEV) status has been reported at this time.
Authenticated remote code execution in n8n workflow automation platform (versions prior to 2.10.1, 2.9.3, and 1.123.22) allows low-privilege users with workflow creation or modification permissions to execute arbitrary system commands on the host. The vulnerability stems from insufficient isolation in the expression evaluation engine, where crafted expressions in workflow parameters can break out of the intended sandbox. Patches are available, no active exploitation has been reported, and the EPSS score of 0.15% indicates low current exploitation probability despite the critical CVSS rating.
Remote code execution in n8n workflow automation platform allows authenticated users with workflow creation or modification permissions to execute arbitrary shell commands by chaining file write operations with git functions to manipulate configuration files. Versions prior to 2.2.0 and 1.123.8 are affected, and administrators should upgrade immediately or restrict workflow editing permissions to trusted users only.
Authenticated users with workflow modification permissions in n8n versions prior to 2.10.1, 2.9.3, and 1.123.22 can exploit the Merge node's SQL query mode to execute arbitrary code and write files on the server. This high-severity vulnerability (CVSS 8.8) affects the AI/ML and workflow automation platform, allowing attackers with legitimate access to achieve complete system compromise. No patch is currently available, and administrators should restrict workflow permissions or disable the Merge node as temporary mitigations.
Code injection in n8n workflow automation before 2.10.1/2.9.3/1.123.22 allows authenticated users to execute arbitrary code by creating or editing workflows with malicious expressions. Third n8n RCE CVE in this release.
Python sandbox escape in n8n workflow automation before 2.10.1/2.9.3/1.123.22. Users who can modify workflows can escape the Python Code node sandbox for full host compromise on instances using internal Task Runners.
Second-order expression injection in n8n workflow automation before 2.10.1/2.9.3/1.123.22. Crafted workflow data triggers expression evaluation leading to code execution. Patch available.
n8n versions 0.187.0 through 1.120.2 contain a command injection vulnerability in the community package installation feature that allows authenticated administrators to execute arbitrary system commands on the host. The vulnerability requires high privilege access and specific conditions to exploit but carries high risk due to potential complete system compromise. A patch is available in version 1.120.3.
n8n has a protection mechanism bypass (CVSS 9.9) in the Python sandbox allowing authenticated users to escape code execution restrictions.
N8N versions up to 1.118.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
n8n is an open source workflow automation platform. [CVSS 8.1 HIGH]
n8n has a command injection vulnerability (CVSS 9.9) allowing authenticated users to execute arbitrary OS commands through workflow definitions.
n8n has a TOCTOU race condition vulnerability (CVSS 9.9) enabling bypass of execution restrictions in workflow processing.
n8n workflow automation platform has an authenticated code execution vulnerability (CVSS 9.9) through improper runtime behavior modification, enabling server takeover.
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through crafted workflow expressions.
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox restrictions and execute arbitrary code on the underlying operating system, with full instance takeover possible in Internal execution mode. Public exploit code exists for this vulnerability, which affects n8n deployments running under Internal execution mode where the Python executor has direct OS access. External execution mode deployments using Docker sidecars have reduced impact as code execution is confined to the container rather than the main node.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with scope change enabling full compromise of both self-hosted and cloud instances. EPSS 12.5% indicates high exploitation activity. Patch available.
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical CVSS 10.0 vulnerability enabling remote attackers to read sensitive files from the server, with potential for further compromise. PoC available.
Path traversal in n8n's Git node allows authenticated workflow editors to exfiltrate the contents of arbitrary local git repositories readable by the n8n process. The flaw exists in `packages/nodes-base/nodes/Git/GenericFunctions.ts`: `setUpstream` writes an unvalidated `branch.<branch>.remote` value into the repository configuration, and a subsequent `fetch` or `pull` resolves the remote from that persisted config rather than the validated `repository` parameter - a TOCTOU-style validation bypass classified as CWE-22. No public exploit has been identified at time of analysis; vendor-released patches are available in versions 1.123.76, 2.37.7, and 2.38.2.
Missing authorization controls in n8n's workflow REST API expose all active workflow IDs, version IDs, and activation error details to any authenticated instance member, regardless of workflow sharing permissions. The flaw spans two surfaces: the /rest/active-workflows endpoint and the real-time push notification service (workflow-push-notifier.service.ts), which broadcasts workflow lifecycle events to clients without per-resource access checks. Patched releases 1.123.76, 2.37.7, and 2.38.2 are available; no public exploit or active exploitation has been identified.
Credential exfiltration in n8n's Log Streaming subsystem allows an authenticated user holding a custom global role with Log Streaming scopes to decrypt and exfiltrate credentials belonging to any other project. The authorization check in destination-credentials-access.ts performs a credential:read scope check but omits an ownership or project-membership check, so any credential ID can be referenced regardless of which project owns it. No public exploit has been identified at time of analysis, but the impact is high-confidentiality for any secret stored in the platform because the decrypted value is sent directly to an attacker-controlled HTTP endpoint.
Missing authorization in n8n's role assignment API allows authenticated project managers to enumerate member names and email addresses from projects they lack permission to access. The /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members endpoints in packages/cli/src/controllers/role.controller.ts verified only the role management permission (role:manageProject) but omitted the required project:list scope check, enabling cross-project member enumeration. Versions prior to 2.37.7 (stable branch) and 2.38.2 (prerelease branch) are affected; vendor-released patches are available.
OIDC SSO authentication bypass in n8n Enterprise allows users with credentials in a previously configured but administratively disabled identity provider to obtain valid application sessions. The public OIDC login and callback endpoints in `packages/cli/src/modules/sso-oidc/oidc.service.ee.ts` lacked an `assertOidcLoginEnabled` guard, meaning disabling OIDC at the n8n configuration level did not actually deactivate the protocol handler. Fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2 per GitHub Security Advisory GHSA-pf83-w3f9-8m37; no public exploit code has been identified at time of analysis.
Webhook signature verification in n8n's GitHub Trigger node fails open when GitHub returns HTTP 422 during webhook registration, causing the platform to reuse an existing webhook while silently discarding the generated secret. Workflow static data then retains a webhookId with no corresponding webhookSecret, and the X-Hub-Signature-256 validation logic accepts any inbound delivery unconditionally, allowing network attackers to inject forged GitHub events and trigger arbitrary workflow executions. Versions prior to 1.123.76 (v1.x), 2.37.7 (v2.x), and 2.38.2 (v2.38.x) are affected; no public exploit or CISA KEV listing has been identified.
Path traversal in n8n's Elasticsearch and ElasticSecurity workflow nodes allows a low-privileged workflow editor to escape the intended Elasticsearch index scope and reach arbitrary indices or cluster administration endpoints using the platform's stored Elasticsearch credentials. Exploitation requires the ability to create or edit workflows containing Elasticsearch nodes, and the root cause is the absence of proper URL path-segment encoding (toPathSegment) in GenericFunctions.ts before identifiers are interpolated into REST request paths. No public exploit code or CISA KEV listing is present at time of analysis, but the scope change to a backend Elasticsearch cluster elevates the real-world impact beyond the CVSS base score suggests.
Prototype pollution in n8n's Instance AI workflow summary feature allows authenticated users to disrupt the main n8n process by submitting crafted workflows via the REST API. The `summarizeWorkflowStructure` function in `packages/@n8n/instance-ai/src/tools/workflows/summarize-workflow.ts` uses workflow node names and connection keys as raw JavaScript object keys without sanitization, so keys such as `__proto__` or `constructor` cause nested writes to reach `Object.prototype` in the main process and corrupt the JavaScript runtime state. This renders the n8n instance unreliable or unavailable for subsequent requests, making it a targeted denial-of-service attack requiring only low-privilege API access. No public exploit and no CISA KEV listing have been identified at time of analysis; patches are available in versions 2.37.7 and 2.38.2.
The /chat WebSocket endpoint in n8n workflow automation platform fails to validate that a supplied resumeToken targets a chat-compatible node, allowing any holder of a valid token - including anonymous form submitters - to bypass Send-and-Wait, non-chat Human-in-the-Loop (HITL), and Wait approval gates in paused workflow executions. Affected versions are n8n below 2.37.7 and n8n 2.38.0-2.38.1, with vendor-confirmed fixes released 2026-09-02. No public exploit code or CISA KEV listing exists at time of analysis, but the integrity impact is directly relevant to organizations relying on n8n for sensitive human-approval workflows.
Server-side request forgery in n8n's Instance AI credential setup flow enables network-accessible attackers to cause the n8n server to issue authenticated requests, redirects, or internal probes to arbitrary unintended origins. The root cause is that the extractServiceOrigin function in credential-utils.ts accepts a credential verification URL from user-influenced input without validating it against the workflow node's expected origin, so attacker-controlled fetched content can further redirect where those requests land. Versions prior to 2.37.7 and the 2.38.0-2.38.1 branch are affected; vendor-released patches exist at 2.37.7 and 2.38.2.
Incorrect OAuth refresh token resource binding in n8n prior to 2.37.7 and 2.38.1 allows an attacker controlling a registered OAuth client to obtain valid access tokens for workflows they were never authorized to access. The first access token issued after user consent was correctly bound to the consented workflow resource, but the accompanying refresh token was not - at refresh time n8n only checked that the requested resource was a registered workflow, not that it matched the original consent grant. No public exploit code or CISA KEV listing has been identified at time of analysis; fixes are confirmed in released versions 2.37.7 and 2.38.1.
Workflow names and execution statistics from arbitrary projects are exposed in n8n versions before 2.36.2 due to missing per-project authorization in the Insights API. Any authenticated user holding an insights-scoped credential can supply arbitrary `projectId` parameters to Insights API routes and retrieve analytics data from projects they have no membership in - a classic IDOR (Insecure Direct Object Reference) pattern. No public exploit code has been identified and the CVSS 4.0 score of 5.3 reflects the limited disclosure scope (execution metadata only, no credential or workflow-payload exposure).
Server-side request forgery in n8n before 2.34.1 allows authenticated low-privileged users to bypass SSRF protection in Code and Function nodes by simultaneously supplying a safe uri parameter and a malicious url parameter to the legacy request helper function. Because the SSRF validation inspects only uri while the HTTP client dispatches using url when both are present, the safety check is rendered ineffective and internal network addresses become reachable. No public exploit or active exploitation has been identified at time of analysis, but the bypass technique is straightforward for any user with Code or Function node authoring rights.
Query injection in n8n's Elasticsearch and Google Cloud Firestore workflow nodes allows a low-privileged authenticated user to escalate a single-document lookup into a full-collection read by injecting quote and brace characters into expression values. Affected versions are n8n before 2.35.4 and 2.36.x before 2.36.2. The CVSS 4.0 vector scores this at 6.3 with high subsequent-system confidentiality impact, reflecting that the vulnerable system itself is not directly compromised but the connected Elasticsearch or Firestore data stores can be fully exposed. No public exploit code or active exploitation has been identified at time of analysis.
SSRF protection bypass in n8n's SearXNG Agent tool allows authenticated users to reach internal network hosts that the platform's own security controls are supposed to block. Affected versions are n8n before 2.34.1 and 2.33.x before 2.33.4 when deployed with N8N_SSRF_PROTECTION_ENABLED=true. An attacker with permission to create SearXNG credentials and configure a personal agent can point the API URL at internal infrastructure - cloud metadata endpoints, internal APIs, or intranet services - and receive responses directly through the agent chat interface. No public exploit or active exploitation (CISA KEV) identified at time of analysis.
Sandbox escape in n8n's JavaScript Code node allows authenticated workflow authors to break out of the Node.js VM sandbox by polluting an unfrozen Function.prototype, ultimately recovering a reference to the host process's globalThis object. Affected are n8n deployments running versions prior to 1.123.69, 2.33.4, and 2.34.1 where users hold workflow creation and execution permissions. Full exploitation also requires that specific Node.js modules are present on the allowlist of the deployment's import configuration, raising practical complexity but making impact highly deployment-dependent. No public exploit code or CISA KEV listing has been identified at time of analysis.
ReDoS in n8n's Filter and Switch nodes allows an authenticated workflow author to monopolize a worker thread indefinitely by supplying a catastrophic backtracking regex compiled via `new RegExp()` without complexity validation or execution timeout. Affected are n8n versions before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1; per-item execution amplifies the impact proportionally to dataset size, stalling all concurrent workflows on the same worker. No public exploit code or CISA KEV listing has been identified at time of analysis.
Credential exfiltration in n8n's GraphQL node allows authenticated workflow authors to bypass per-credential allowed-domains enforcement. When the node's Authentication parameter is set to expression mode and two credentials of different types are attached, the platform enforces the domain restriction of only the first credential while silently forwarding secret material from the second to any destination - including attacker-controlled endpoints. No public exploit has been identified at time of analysis, but the CVSS 4.0 subsequent-system confidentiality impact is rated High, reflecting the downstream value of an exfiltrated credential that may carry permissions well beyond the n8n instance.
Server-side request forgery and MVG code injection in n8n's Edit Image node allows authenticated low-privilege users to issue blind outbound HTTP requests or read local files by injecting ImageMagick MVG primitives into the Draw Text operation. All n8n versions before 1.123.69 are affected, confirmed by vendor advisory GHSA-233r-fpgw-fx8x. No public exploit identified at time of analysis, but the High confidentiality impact in the CVSS 4.0 vector signals meaningful data exfiltration risk for instances co-located with sensitive internal services or cloud metadata endpoints.
Cross-project credential reference injection in n8n before 2.34.1 allows low-privileged attackers holding a valid MCP Bearer API key to bypass authorization controls in the create_workflow_from_code MCP tool and embed references to credentials belonging to other projects into workflows they should not control. The bypass is conditional on the credential authentication type being set to 'expression', at which point n8n fails to enforce project-scoped authorization on credential objects. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 5.3 reflects a realistic, low-complexity network attack by authenticated users.
SSRF protection bypass in n8n's OAuth2 credential token-exchange flow allows authenticated users holding credential-creation permissions to direct n8n's backend to issue HTTP POST requests to arbitrary internal network addresses. Affected deployments span all n8n releases prior to 1.123.69 (v1 branch), 2.33.4 (v2.33 branch), and 2.34.1 (v2.34 branch). While n8n applies SSRF guards to OAuth2 discovery and dynamic-client-registration requests, the access-token exchange step uses a separate, unguarded HTTP client, meaning a malicious credential configuration bypasses those controls entirely and reflects internal service responses back to the attacker. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 base score of 2.3 reflects the constrained impact and privilege requirement.
SQL injection in n8n's PostgresTrigger node enables authenticated users to execute arbitrary SQL against connected PostgreSQL databases with the configured credential's full privileges. Affected versions span the n8n 1.x branch before 1.123.67, the 2.x branch before 2.31.5, and the 2.32.x branch before 2.32.1. Successful exploitation yields unrestricted read and write access to the backend PostgreSQL instance - a scope-change impact confirmed by the CVSS 4.0 SC:H/SI:H/SA:H rating - with no public exploit identified at time of analysis and no CISA KEV listing.
Path traversal in n8n's @n8n/computer-use search_files tool exposes arbitrary local files to any actor who can control the tool's search input. Affected versions span all n8n releases before 2.31.5 and the entire 2.32.x branch before 2.32.1, limited to deployments that run AI agent workflows leveraging the computer-use package. An authenticated low-privileged user can bypass the configured base-directory sandbox and retrieve the names and contents of any file readable by the n8n daemon's OS user account. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Prototype pollution in n8n's VM expression engine enables authenticated workflow editors to escape the sandbox and crash the main n8n process by obtaining a reference to a host built-in and corrupting its prototype. Affected versions span the entire 1.x branch prior to 1.123.67 and two 2.x patch lines (before 2.31.5 and 2.32.1), covering both self-hosted deployments and n8n cloud instances using the VM expression engine. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the sandbox escape primitive is technically significant and poses meaningful risk in multi-tenant or loosely-governed deployments.
SSRF protection bypass in n8n's MCP Client node allows any authenticated user with workflow creation or editing rights to reach internal or blocked hosts and read responses back through the workflow. The MCP Client node neither routes outbound requests through n8n's SSRF protection layer nor pins the resolved IP address after DNS resolution, undermining the platform's intended network isolation guarantees. Vendor-released patches exist in versions 2.31.5 and 2.32.1; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Code injection in n8n's legacy expression engine allows an authenticated user to replace the mutable global JSON.stringify function within expression evaluation, causing subsequent code-generation paths to embed and execute attacker-controlled JavaScript. Affected are all n8n versions prior to 1.123.76 (v1 branch), 2.37.7, and 2.38.2. The vulnerability is confined to the legacy expression engine (isolated-vm-bridge.ts and ExpressionBuilder.ts); the vm expression engine is unaffected. No public exploit or CISA KEV listing has been identified at time of analysis.
Credential exfiltration in n8n's OpenAI Chat Model node allows an authenticated workflow editor to redirect the model-search dropdown request - including the attached OpenAI API key - to an arbitrary attacker-controlled host by overriding `options.baseURL`. Affected versions span the v1 branch prior to 1.123.76 and the v2 branch prior to 2.37.7 and 2.38.2; the root cause is the omission of `assertOpenAiCredentialAllowsUrl` in `loadModels.ts`, the same domain-restriction guard applied elsewhere in the node. No active exploitation or public exploit code has been identified at time of analysis; vendor-released patches are available across all three branches.
Remote code execution in n8n workflow automation platform prior to versions 1.123.76, 2.37.7, and 2.38.2 is achievable by any authenticated user who can author workflow expressions. The root cause is a sandbox escape in the PrototypeSanitizer AST hook: because the sanitizer references itself via dynamically scoped `this`, a crafted class field named `__sanitize` rebinds the sanitizer function, after which the expression freely invokes the JavaScript `Function()` constructor and executes arbitrary Node.js code on the backend. No public exploit has been identified at time of analysis, but the Function constructor escape technique is well-documented in the JavaScript security research community, lowering the barrier to independent rediscovery.
Unvalidated input sizes on the OAuth Dynamic Client Registration endpoint in n8n allow unauthenticated remote attackers to exhaust database storage by repeatedly submitting oversized client_name and grant_types values. Affected versions are all n8n releases prior to 2.37.7 (in the 2.37.x branch) and prior to 2.38.2 (in the 2.38.x branch). Because the endpoint is publicly accessible without authentication and the attack is trivially automatable, a single attacker can render the n8n instance unavailable by filling database disk capacity, taking down all workflow automation for any organization relying on the platform.
Credential exposure in n8n's Strapi, SeaTable, and Mailcheck integration nodes causes plaintext API secrets to persist in execution error logs, readable by any authenticated user via the REST API. The three affected nodes pass decrypted credentials to external authentication endpoints through a legacy HTTP helper that lacks error-handling wrappers; when those calls fail, the raw secret is written into execution error records rather than being suppressed or redacted. This bypasses n8n's credential API blank-value redaction, effectively leaking third-party service credentials to any n8n user who can inspect execution results. No public exploit or CISA KEV listing exists at time of analysis; patches are available in versions 1.123.73, 2.35.4, and 2.36.2.
Local file read and server-side request forgery (SSRF) in n8n's Gmail (v1) and Brevo workflow nodes allow an authenticated low-privilege user to exfiltrate files accessible to the n8n process or probe internal network endpoints by supplying a crafted expression that resolves to a JavaScript object with a `path` or `href` property. Affected versions span the stable branch before 1.123.73 and the 2.x branch before 2.35.4 and 2.36.2, as confirmed by vendor advisory GHSA-95ph-833c-4wrp. No public exploit has been identified at time of analysis, but the attack mechanism is well-defined and low-complexity for any user with workflow creation rights.
Prototype chain sandbox escape in n8n's $fromAI expression handler allows any user holding workflow-build privilege to achieve remote code execution within the main n8n server process. The $fromAI handler failed to restrict placeholder key lookup to own properties and permitted reserved prototype keys; when the input value is a primitive, the handler returns a live reference to the host-prototype chain, enabling traversal to Function.prototype.constructor and compilation of arbitrary JavaScript outside the expression sandbox. All n8n deployments running versions below 1.123.73 (v1 track), 2.35.4, or 2.36.2 (v2 track) are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the technique (prototype chain walk to Function constructor) is well-understood and reliable once sandbox access is obtained.
Remote code execution in n8n's Git node allows an authenticated workflow user to execute arbitrary OS commands as the n8n process user by pointing the node at a repository containing malicious git configuration. The vulnerability arises from an incomplete sanitization list that omitted the content-filter and merge-driver git configuration key families, allowing those keys to survive into git operations and trigger arbitrary command execution during routine Add, Commit, Checkout, or Pull operations. Patched versions 1.123.73, 2.35.4, and 2.36.2 are confirmed available; no public exploit or CISA KEV listing has been identified at time of analysis.
Credential exfiltration in n8n's workflow execution engine allows a low-privileged authenticated user to reference another user's credentials inside an inline sub-workflow node (such as the Workflow Tool node) without any ownership validation. Affected versions are n8n before 2.35.4 and 2.36.x before 2.36.2. When a privileged execution context later runs the poisoned workflow and resolves the referenced secret, the sub-workflow can forward the plaintext credential to an attacker-controlled endpoint. No public exploit code has been identified at time of analysis, but the VulnCheck advisory corroborates the GitHub Security Advisory GHSA-4r56-g65c-fm83.
Expression sandbox bypass in n8n before 2.36.2 allows authenticated workflow editors to escape the sandboxed evaluation environment by placing free identifiers in spread, computed-key, switch-case, or class-extension positions, which resolve against Node.js process globals instead of the restricted sandbox scope. Exploiting this flaw enables mutation of host objects - including prototype chains or environment-level state - with those changes persisting process-wide until the n8n service is restarted, affecting all concurrent workflows and users on the same instance. No public exploit or CISA KEV listing has been identified at time of analysis; patch version 2.36.2 is confirmed via the GitHub Security Advisory.
Code execution in n8n's Git node (all 1.x releases before 1.123.69, all 2.x releases before 2.33.4 and 2.34.1) allows an authenticated attacker who can also plant files on the n8n host to run arbitrary OS commands as the n8n process user. The Git node passes repository-local git configuration values directly to execution without neutralization, satisfying CWE-78 (OS Command Injection); triggering any Git node operation against a repository whose config has been poisoned fires the injected command automatically. No public exploit has been identified at time of analysis, but the high impact triad (VC:H/VI:H/VA:H) and confirmed patch availability make immediate upgrading the correct response.
Arbitrary file read and write in n8n's Snowflake node allows an authenticated low-privileged user to exfiltrate or overwrite files on the n8n host by injecting Snowflake client-side commands (PUT/GET) into the Execute Query input field, bypassing n8n's own file-access restrictions. Affected versions span n8n before 1.123.69, all 2.x builds before 2.33.4, and 2.34.x before 2.34.1, as confirmed by vendor advisory GHSA-r4j2-j3wm-q689. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and the low barrier to exploitation - requiring only n8n credentials plus access to a Snowflake connection - make this a high-priority remediation.
Privilege escalation in n8n's custom project role management allows users holding only the narrow `role:manageProject` global scope to seize full administrative control over arbitrary projects across the entire instance. The root cause is a missing project-level authorization check in the role deletion-with-reassignment code path: the API validates only that the reassignment target role exists and is project-scoped, never verifying that the requesting user has any rights over the affected projects or their members. No public exploit has been identified and no CISA KEV listing exists at time of analysis; patches are confirmed available in versions 2.33.4 and 2.34.1.
Prototype pollution in n8n's JavaScript task runner sandbox allows an authenticated user with Code node access to escape VM isolation and execute arbitrary OS commands within the runner container. Affected versions span the v1.x branch before 1.123.69 and the v2.x branch before 2.33.4 and 2.34.1. The corruption is process-wide, meaning a single malicious execution can poison the prototype chain for all subsequent tenant Code node runs on the same shared runner; on v1.x instances without task runner isolation, the attack surface escalates to the main n8n process itself. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE.
Decrypted credential secrets are exposed in execution logs in n8n workflow automation software across versions before 1.123.69, 2.33.4, and 2.34.1. The GraphQL node fails to wrap connection-level HTTP client errors in n8n's standard error type, propagating raw error objects - which carry decrypted credential headers - directly into the persistent execution record. Any authenticated user with read access to workflow execution history can recover those plaintext secrets. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the low-privilege access requirement and direct credential exposure make this a high-priority remediation target for shared or multi-tenant deployments.
Expression injection in n8n's workflow editor allows an authenticated member to store a malicious payload in a resource-locator field that executes as JavaScript in any other user's browser session when they open the affected node. The root cause is that the editor splices the field's stored value directly into the node type's URL template without sanitizing expression syntax, enabling cross-user script execution within authenticated sessions. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.4 reflects high confidentiality and integrity impact on the vulnerable system.
Stored XSS in n8n's Form node completion page allows a low-privileged authenticated workspace member to bypass the origin's Content-Security-Policy and deliver arbitrary scripts to public form submitters. The flaw stems from a conditional CSP application gap: sandboxing was only enforced when `respondWith` was not set to 'redirect', yet `responseText` was rendered as raw HTML regardless of that setting. Scripts injected this way execute same-origin with the victim's n8n session, enabling session token theft, credential harvesting, or unauthorized actions. No public exploit code or CISA KEV listing has been identified at time of analysis.
PostgREST filter injection in n8n's Supabase integration node exposes any connected Supabase database to full-table disclosure, deletion, or modification across versions before 1.123.69, 2.33.4, and 2.34.1. The Row Get Many, Delete, and Update operations concatenate expression-bindable values into filter queries without sanitization, allowing an attacker who can supply input to a workflow to widen a scoped filter into an unfiltered full-table operation. No public exploit identified at time of analysis, but the CVSS 4.0 subsequent-system impact is rated high across confidentiality, integrity, and availability, reflecting the catastrophic downstream database risk.
NoSQL injection in n8n's MongoDB integration node (Find, Delete, and Aggregate operations) allows an attacker who can supply externally-controlled data into a workflow query to inject MongoDB operators such as $ne or $where, transforming an intended single-document lookup into full-collection disclosure, mass deletion, or arbitrary database operations. Versions prior to 1.123.69 (v1 branch) and 2.33.4 / 2.34.1 (v2 branch) are affected, per vendor advisory GHSA-953p-jm2c-8h5j. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 subsequent-system impact is rated High across confidentiality, integrity, and availability.
Remote code execution in n8n workflow automation platform (versions before 2.33.4 and 2.34.x before 2.34.1) arises from a path traversal flaw in the @n8n/workflow-sdk MCP node-schema loader. An authenticated user holding global:member privileges can supply a crafted node type string containing path-traversal sequences, causing the loader to resolve and execute an arbitrary file on the server filesystem as a Node.js module within the n8n main process. No public exploit has been identified at time of analysis and the vulnerability is not in the CISA KEV catalog, but the low privilege requirement and straightforward exploitability make this a high-priority patch for all self-hosted n8n deployments.
Remote code execution in n8n workflow automation platform (all versions prior to 1.123.64, 2.29.8, and 2.30.1) stems from a TOCTOU race condition in the Git node's clone operation, allowing any low-privileged authenticated user to achieve arbitrary JavaScript execution on the server. The attacker wins a race between path validation and the actual clone, replacing a legitimate directory with a symlink to plant a crafted repository in n8n's community node directory - which the platform loads and executes as trusted JavaScript on the next restart. Both self-hosted and cloud-hosted n8n instances are affected wherever authenticated users can create and run workflows containing the Git node; no public exploit or CISA KEV listing has been identified at time of analysis.
Credential authorization bypass in n8n's HTTP Request node allows an authenticated member with edit access to a shared workflow to silently exfiltrate or use another user's credential by setting the credential type field via a dynamic expression. The pre-execution permission check evaluates the unresolved expression string rather than its runtime-resolved value, causing the ownership check to be skipped entirely while the actual credential is loaded at execution time. Versions 1.123.67, 2.31.5, and 2.32.1 contain the fix; no public exploit has been identified at time of analysis.
Account takeover in n8n before 2.32.1 (and before 2.31.5 in the prior release line) is enabled by two simultaneous omissions in the Token Exchange Embed Login feature: the platform accepts an incoming JWT's email claim without confirming the issuer has cryptographically verified that address, and it does not enforce the trusted key's configured role ceiling against the matched local account. An attacker able to obtain any validly-signed token from a configured trusted issuer - including issuers that routinely emit unverified email addresses as part of their standard flows - can present that token with a victim user's email and be granted a fully authenticated n8n session with complete account control. No public exploit has been identified at time of analysis; however, the vulnerability is exploitable in straightforward steps once both deployment preconditions are satisfied.
Credential exfiltration in n8n's AI and LLM workflow nodes allows low-privileged users with use-only access to shared credentials to bypass the 'Allowed HTTP Request Domains' allowlist and redirect credential secrets to attacker-controlled infrastructure. Affected are all n8n npm installations before version 2.31.5 and the 2.32.0 release (fixed in 2.32.1), where at least one credential has domain restrictions configured and is shared with non-owner users. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the attack is low-complexity for any insider or compromised low-privilege account.
Path traversal in n8n's Git node before versions 1.123.67, 2.31.5, and 2.32.1 allows authenticated low-privilege users to escape the repository sandbox during fetch, pull, and push-tags operations. By pointing an allowlisted remote configuration value at a local filesystem path outside the intended sandbox, an attacker with workflow create/execute rights can pull arbitrary local git repositories into the workspace and read their files and full commit history, including any secrets or credentials stored in git history. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low complexity and low-privilege attack path make it a realistic insider or compromised-account threat in multi-user n8n deployments.
Remote code execution in n8n's Git node allows authenticated users with workflow creation and execution rights to run arbitrary OS commands as the n8n process user by staging a crafted repository that triggers git hook execution under default git security settings. All 1.x versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 are affected across both self-hosted and cloud deployments. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity attack path and broad version coverage make this a high-priority patch for any deployment permitting untrusted authenticated users.
Type confusion in the Send Email node of the n8n workflow automation platform allows an attacker-supplied non-string expression value to pass uncoerced into Nodemailer, which then interprets it as a file path or URL rather than literal email content - enabling arbitrary local file disclosure and server-side request forgery (SSRF). Affected are n8n versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1, as confirmed by GitHub Security Advisory GHSA-2x35-3fw4-9jr4. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; exploitation depends on a specific non-default workflow configuration that requires an unauthenticated webhook, pre-configured SMTP credentials, and direct mapping of untrusted input into the email body field.
Expression sandbox escape in n8n's workflow engine allows any authenticated user with workflow creation or modification permissions to execute arbitrary operating system commands on the host running n8n. The flaw, classified as CWE-94 code injection, affects all npm releases of n8n-io/n8n prior to version 2.31.5 and all 2.32.x releases prior to 2.32.1. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and the full confidentiality, integrity, and availability impact ratings reflect a genuine high-severity remote code execution primitive for any n8n deployment where workflow editing rights are not tightly controlled.
Credential exfiltration in n8n's workflow automation platform allows any user with Editor access to a shared workflow to bypass authorization checks and use or exfiltrate credentials they are not permitted to access. The flaw exists because n8n validates credential permissions only for a node's top-level credential references, not for credentials embedded inside an Execute Sub-workflow node's inline workflow JSON (Source = Parameter); the embedded reference passes both save-time and runtime validation and resolves using the parent workflow's project context. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 7.2 reflects a credible, low-complexity path to high-confidentiality impact when workflow sharing is in use.
Arbitrary file write in n8n's Edit Image node allows authenticated workflow users to escape the node's designated working directory by injecting unsanitized format parameter values into the underlying image library. All n8n releases before 1.123.67 on the 1.x line, before 2.31.5 on the 2.x line, and before 2.32.1 on the 2.32.x line are affected, as confirmed by the GHSA-xmc9-4f2h-jf9c advisory from the n8n maintainers. No public exploit code has been identified at time of analysis, but patched versions and a remediation commit are available, and no special attacker position beyond workflow execution privileges is required.
Prototype pollution in n8n's Edit Fields (Set) node allows any authenticated user with workflow execution permissions to corrupt a shared global in the main Node.js process, triggering an instance-wide denial of service that locks out all users until a manual process restart. Affected are all n8n releases before 1.123.67, 2.31.5, and 2.32.1 across the 1.x and 2.x branches. The attack requires only a low-privilege authenticated account and no special configuration, making this a high operational priority for any multi-user or shared n8n deployment; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Server-side remote code execution in n8n workflow automation (self-hosted and cloud) before 1.123.64, 2.29.8, and 2.30.1 lets authenticated users abuse a TOCTOU race in the Git node's clone operation to write a malicious repository into the community node directory, which n8n auto-loads and executes on the next restart. The flaw bypasses path validation by swapping a validated directory for a symlink before the clone runs, turning a low-privilege account into arbitrary JavaScript execution on the host. No public exploit identified at time of analysis; reported by VulnCheck.
DOM-based cross-site scripting in n8n's HTML preview lets an authenticated global:member user execute JavaScript in the editor's same origin when a victim opens the preview. Because execution output is rendered into an iframe srcdoc without the sandbox attribute and a sanitizer bypass defeats the filtering, injected script runs same-origin and can invoke authenticated APIs using the victim's session, enabling account and workflow takeover. No public exploit identified at time of analysis; the flaw was reported by VulnCheck and is fixed in n8n 1.123.64, 2.29.8, and 2.30.1.
Privilege escalation and potential remote code execution affects n8n workflow-automation instances before 2.30.1 and 2.29.8 where both the Token Exchange module and Public API are enabled. Because JWTs issued via Token Exchange are granted the full set of Public API key scopes irrespective of the acting user's role, a low-privileged user holding a valid external JWT trusted by a configured issuer can invoke administrator-only operations - creating, deleting, or escalating users, and, where unverified Community Package installation is permitted, executing arbitrary code. No public exploit identified at time of analysis; VulnCheck-reported with a CVSS 4.0 base of 8.9.
Stored DOM cross-site scripting in n8n's Resource Locator component allows a low-privileged workflow author to execute arbitrary JavaScript in another user's browser session. The flaw stems from the workflow-persisted cachedResultUrl value being passed to window.open() without scheme validation, letting a javascript: URI fire when a victim opens the crafted workflow and clicks an external link. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but exploitation is realistic in shared/multi-tenant n8n instances.
Host-level remote code execution in n8n (n8n-io) occurs when an authenticated user with workflow create or modify permissions crafts a malicious expression that bypasses the sanitizer in the legacy expression evaluator's computed-member handler, executing arbitrary code as the n8n process. Because the legacy expression engine is the default in affected versions, standard deployments are exposed without any special configuration. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and carries a high CVSS 4.0 base score of 8.9.
Privilege escalation in n8n Enterprise SSO (versions before 1.123.64, 2.29.8, and 2.30.1) lets an SSO-authenticated user who controls their IdP-asserted instance-role claim be provisioned directly as global:owner, seizing full administrative control of workflows, credentials, users, and instance configuration. The instance-role provisioning path fails to block the owner role that the parallel token-exchange path explicitly rejects. Reported by VulnCheck with no public exploit identified at time of analysis; exploitation depends on a non-default configuration.
Privilege escalation in n8n workflow automation platform before 2.30.1 allows a low-privileged Project Viewer to abuse the AI Agents feature, where the node-execution (run-node) tool omits authorization checks. By chatting with an agent that has node tools enabled, the viewer can execute arbitrary nodes and read credential secrets they should not access. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Credential disclosure in n8n workflow automation (versions prior to 1.123.61, 2.27.4, and 2.28.1) allows an authenticated member holding use-only editor access to a shared workflow to read credential-populated HTTP headers via the $request object inside an HTTP Request node's pagination expression, then exfiltrate the secret through returned item data. This defeats n8n's credential-hiding model, which is supposed to prevent low-privilege collaborators from seeing the underlying secret values. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the EPSS/POC signals were not provided.
Privilege escalation via prototype pollution in n8n workflow automation lets an authenticated low-privilege user (holding the default workflow:create permission) corrupt Object.prototype through a crafted workflow saved, updated, or imported via the workflow API. Once polluted, subsequent unauthenticated requests are evaluated as a privileged user, exposing internal user and project listing endpoints. This is an information-disclosure and access-control flaw with no public exploit identified at time of analysis; CVSS 4.0 base score is 7.1.
Authentication bypass in n8n's external identity resolution lets an attacker impersonate other users when the instance trusts more than one token-exchange issuer. Affecting n8n before 2.27.4 and version 2.28.0, the flaw stems from resolving federated identities using only the JWT sub claim while ignoring the iss claim, so a valid token from one trusted issuer whose sub matches a victim registered under a different issuer grants full access to that victim's account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the authentication-level impact (VC:H/VI:H) makes it a meaningful account-takeover risk for multi-issuer SSO deployments.
Credential secret exfiltration in n8n (self-hosted workflow automation) prior to 2.27.4 and 2.28.1 lets a low-privilege member with use-only access to a shared credential leak that secret to an attacker-controlled server. The AI Agents feature fails to enforce the 'Allowed HTTP Request Domains' restriction when an MCP tool is aimed at an arbitrary URL, so the guardrail meant to keep secrets in-bounds is bypassed. No public exploit identified at time of analysis; risk is elevated because the abuse comes from an already-authorized internal user rather than an outside attacker.
Authenticated users in n8n versions prior to 1.123.23 and 2.6.4 can bypass external secrets permission checks to retrieve plaintext secret values from configured vaults by referencing secrets by name in credentials, even without list permissions. This allows unauthorized access to sensitive vault-stored credentials without requiring admin or owner privileges, provided the attacker knows or can guess the target secret name. Public exploit code exists for this vulnerability.
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute arbitrary SQL queries against PostgreSQL backends, enabling data modification and deletion. Public exploit code exists for this vulnerability. Affected versions prior to 1.123.26, 2.13.3, and 2.14.1 should be upgraded immediately, or workflow creation/editing permissions should be restricted to trusted users only.
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenticated users with workflow creation or modification permissions to achieve remote code execution. Versions prior to 2.14.1, 2.13.3, and 1.123.27 are affected. The CVSS score of 9.4 (Critical) reflects network-based exploitation with low complexity requiring only low-level authentication, though no current KEV listing or public POC availability is indicated in the provided intelligence.
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP email attribute to match a target account's email address, gaining full access that persists even after reverting the email change. This authentication bypass (CWE-287) affects n8n versions prior to 2.4.0 and 1.121.0 where LDAP is configured, and public exploit code exists. The vulnerability requires LDAP to be actively enabled and the attacker to control their own LDAP email attribute, creating a critical account takeover risk for administrators.
n8n workflow automation platform Community Edition contains an authorization bypass vulnerability allowing authenticated users with member-level privileges to steal plaintext credentials from other users. The flaw chains name-based credential resolution that doesn't enforce ownership with a permissions bypass affecting generic HTTP credential types (httpBasicAuth, httpHeaderAuth, httpQueryAuth). Attackers can decrypt and exfiltrate credentials without authorization, though native integration credentials remain unaffected.
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit the Merge node's 'Combine by SQL' mode to read arbitrary local files on the n8n host and achieve remote code execution. n8n versions prior to 2.14.1, 2.13.3, and 1.123.26 are affected. The vulnerability carries a CVSS 4.0 score of 9.4 (Critical) due to insufficient sandbox restrictions in the AlaSQL component, allowing SQL injection-style attacks against the host system. No public proof-of-concept or active exploitation (KEV) status has been reported at this time.
Authenticated remote code execution in n8n workflow automation platform (versions prior to 2.10.1, 2.9.3, and 1.123.22) allows low-privilege users with workflow creation or modification permissions to execute arbitrary system commands on the host. The vulnerability stems from insufficient isolation in the expression evaluation engine, where crafted expressions in workflow parameters can break out of the intended sandbox. Patches are available, no active exploitation has been reported, and the EPSS score of 0.15% indicates low current exploitation probability despite the critical CVSS rating.
Remote code execution in n8n workflow automation platform allows authenticated users with workflow creation or modification permissions to execute arbitrary shell commands by chaining file write operations with git functions to manipulate configuration files. Versions prior to 2.2.0 and 1.123.8 are affected, and administrators should upgrade immediately or restrict workflow editing permissions to trusted users only.
Authenticated users with workflow modification permissions in n8n versions prior to 2.10.1, 2.9.3, and 1.123.22 can exploit the Merge node's SQL query mode to execute arbitrary code and write files on the server. This high-severity vulnerability (CVSS 8.8) affects the AI/ML and workflow automation platform, allowing attackers with legitimate access to achieve complete system compromise. No patch is currently available, and administrators should restrict workflow permissions or disable the Merge node as temporary mitigations.
Code injection in n8n workflow automation before 2.10.1/2.9.3/1.123.22 allows authenticated users to execute arbitrary code by creating or editing workflows with malicious expressions. Third n8n RCE CVE in this release.
Python sandbox escape in n8n workflow automation before 2.10.1/2.9.3/1.123.22. Users who can modify workflows can escape the Python Code node sandbox for full host compromise on instances using internal Task Runners.
Second-order expression injection in n8n workflow automation before 2.10.1/2.9.3/1.123.22. Crafted workflow data triggers expression evaluation leading to code execution. Patch available.
n8n versions 0.187.0 through 1.120.2 contain a command injection vulnerability in the community package installation feature that allows authenticated administrators to execute arbitrary system commands on the host. The vulnerability requires high privilege access and specific conditions to exploit but carries high risk due to potential complete system compromise. A patch is available in version 1.120.3.
n8n has a protection mechanism bypass (CVSS 9.9) in the Python sandbox allowing authenticated users to escape code execution restrictions.
N8N versions up to 1.118.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
n8n is an open source workflow automation platform. [CVSS 8.1 HIGH]
n8n has a command injection vulnerability (CVSS 9.9) allowing authenticated users to execute arbitrary OS commands through workflow definitions.
n8n has a TOCTOU race condition vulnerability (CVSS 9.9) enabling bypass of execution restrictions in workflow processing.
n8n workflow automation platform has an authenticated code execution vulnerability (CVSS 9.9) through improper runtime behavior modification, enabling server takeover.
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through crafted workflow expressions.
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox restrictions and execute arbitrary code on the underlying operating system, with full instance takeover possible in Internal execution mode. Public exploit code exists for this vulnerability, which affects n8n deployments running under Internal execution mode where the Python executor has direct OS access. External execution mode deployments using Docker sidecars have reduced impact as code execution is confined to the container rather than the main node.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with scope change enabling full compromise of both self-hosted and cloud instances. EPSS 12.5% indicates high exploitation activity. Patch available.
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical CVSS 10.0 vulnerability enabling remote attackers to read sensitive files from the server, with potential for further compromise. PoC available.
Path traversal in n8n's Git node allows authenticated workflow editors to exfiltrate the contents of arbitrary local git repositories readable by the n8n process. The flaw exists in `packages/nodes-base/nodes/Git/GenericFunctions.ts`: `setUpstream` writes an unvalidated `branch.<branch>.remote` value into the repository configuration, and a subsequent `fetch` or `pull` resolves the remote from that persisted config rather than the validated `repository` parameter - a TOCTOU-style validation bypass classified as CWE-22. No public exploit has been identified at time of analysis; vendor-released patches are available in versions 1.123.76, 2.37.7, and 2.38.2.
Missing authorization controls in n8n's workflow REST API expose all active workflow IDs, version IDs, and activation error details to any authenticated instance member, regardless of workflow sharing permissions. The flaw spans two surfaces: the /rest/active-workflows endpoint and the real-time push notification service (workflow-push-notifier.service.ts), which broadcasts workflow lifecycle events to clients without per-resource access checks. Patched releases 1.123.76, 2.37.7, and 2.38.2 are available; no public exploit or active exploitation has been identified.
Credential exfiltration in n8n's Log Streaming subsystem allows an authenticated user holding a custom global role with Log Streaming scopes to decrypt and exfiltrate credentials belonging to any other project. The authorization check in destination-credentials-access.ts performs a credential:read scope check but omits an ownership or project-membership check, so any credential ID can be referenced regardless of which project owns it. No public exploit has been identified at time of analysis, but the impact is high-confidentiality for any secret stored in the platform because the decrypted value is sent directly to an attacker-controlled HTTP endpoint.
Missing authorization in n8n's role assignment API allows authenticated project managers to enumerate member names and email addresses from projects they lack permission to access. The /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members endpoints in packages/cli/src/controllers/role.controller.ts verified only the role management permission (role:manageProject) but omitted the required project:list scope check, enabling cross-project member enumeration. Versions prior to 2.37.7 (stable branch) and 2.38.2 (prerelease branch) are affected; vendor-released patches are available.
OIDC SSO authentication bypass in n8n Enterprise allows users with credentials in a previously configured but administratively disabled identity provider to obtain valid application sessions. The public OIDC login and callback endpoints in `packages/cli/src/modules/sso-oidc/oidc.service.ee.ts` lacked an `assertOidcLoginEnabled` guard, meaning disabling OIDC at the n8n configuration level did not actually deactivate the protocol handler. Fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2 per GitHub Security Advisory GHSA-pf83-w3f9-8m37; no public exploit code has been identified at time of analysis.
Webhook signature verification in n8n's GitHub Trigger node fails open when GitHub returns HTTP 422 during webhook registration, causing the platform to reuse an existing webhook while silently discarding the generated secret. Workflow static data then retains a webhookId with no corresponding webhookSecret, and the X-Hub-Signature-256 validation logic accepts any inbound delivery unconditionally, allowing network attackers to inject forged GitHub events and trigger arbitrary workflow executions. Versions prior to 1.123.76 (v1.x), 2.37.7 (v2.x), and 2.38.2 (v2.38.x) are affected; no public exploit or CISA KEV listing has been identified.
Path traversal in n8n's Elasticsearch and ElasticSecurity workflow nodes allows a low-privileged workflow editor to escape the intended Elasticsearch index scope and reach arbitrary indices or cluster administration endpoints using the platform's stored Elasticsearch credentials. Exploitation requires the ability to create or edit workflows containing Elasticsearch nodes, and the root cause is the absence of proper URL path-segment encoding (toPathSegment) in GenericFunctions.ts before identifiers are interpolated into REST request paths. No public exploit code or CISA KEV listing is present at time of analysis, but the scope change to a backend Elasticsearch cluster elevates the real-world impact beyond the CVSS base score suggests.
Prototype pollution in n8n's Instance AI workflow summary feature allows authenticated users to disrupt the main n8n process by submitting crafted workflows via the REST API. The `summarizeWorkflowStructure` function in `packages/@n8n/instance-ai/src/tools/workflows/summarize-workflow.ts` uses workflow node names and connection keys as raw JavaScript object keys without sanitization, so keys such as `__proto__` or `constructor` cause nested writes to reach `Object.prototype` in the main process and corrupt the JavaScript runtime state. This renders the n8n instance unreliable or unavailable for subsequent requests, making it a targeted denial-of-service attack requiring only low-privilege API access. No public exploit and no CISA KEV listing have been identified at time of analysis; patches are available in versions 2.37.7 and 2.38.2.
The /chat WebSocket endpoint in n8n workflow automation platform fails to validate that a supplied resumeToken targets a chat-compatible node, allowing any holder of a valid token - including anonymous form submitters - to bypass Send-and-Wait, non-chat Human-in-the-Loop (HITL), and Wait approval gates in paused workflow executions. Affected versions are n8n below 2.37.7 and n8n 2.38.0-2.38.1, with vendor-confirmed fixes released 2026-09-02. No public exploit code or CISA KEV listing exists at time of analysis, but the integrity impact is directly relevant to organizations relying on n8n for sensitive human-approval workflows.
Server-side request forgery in n8n's Instance AI credential setup flow enables network-accessible attackers to cause the n8n server to issue authenticated requests, redirects, or internal probes to arbitrary unintended origins. The root cause is that the extractServiceOrigin function in credential-utils.ts accepts a credential verification URL from user-influenced input without validating it against the workflow node's expected origin, so attacker-controlled fetched content can further redirect where those requests land. Versions prior to 2.37.7 and the 2.38.0-2.38.1 branch are affected; vendor-released patches exist at 2.37.7 and 2.38.2.
Incorrect OAuth refresh token resource binding in n8n prior to 2.37.7 and 2.38.1 allows an attacker controlling a registered OAuth client to obtain valid access tokens for workflows they were never authorized to access. The first access token issued after user consent was correctly bound to the consented workflow resource, but the accompanying refresh token was not - at refresh time n8n only checked that the requested resource was a registered workflow, not that it matched the original consent grant. No public exploit code or CISA KEV listing has been identified at time of analysis; fixes are confirmed in released versions 2.37.7 and 2.38.1.
Workflow names and execution statistics from arbitrary projects are exposed in n8n versions before 2.36.2 due to missing per-project authorization in the Insights API. Any authenticated user holding an insights-scoped credential can supply arbitrary `projectId` parameters to Insights API routes and retrieve analytics data from projects they have no membership in - a classic IDOR (Insecure Direct Object Reference) pattern. No public exploit code has been identified and the CVSS 4.0 score of 5.3 reflects the limited disclosure scope (execution metadata only, no credential or workflow-payload exposure).
Server-side request forgery in n8n before 2.34.1 allows authenticated low-privileged users to bypass SSRF protection in Code and Function nodes by simultaneously supplying a safe uri parameter and a malicious url parameter to the legacy request helper function. Because the SSRF validation inspects only uri while the HTTP client dispatches using url when both are present, the safety check is rendered ineffective and internal network addresses become reachable. No public exploit or active exploitation has been identified at time of analysis, but the bypass technique is straightforward for any user with Code or Function node authoring rights.
Query injection in n8n's Elasticsearch and Google Cloud Firestore workflow nodes allows a low-privileged authenticated user to escalate a single-document lookup into a full-collection read by injecting quote and brace characters into expression values. Affected versions are n8n before 2.35.4 and 2.36.x before 2.36.2. The CVSS 4.0 vector scores this at 6.3 with high subsequent-system confidentiality impact, reflecting that the vulnerable system itself is not directly compromised but the connected Elasticsearch or Firestore data stores can be fully exposed. No public exploit code or active exploitation has been identified at time of analysis.
SSRF protection bypass in n8n's SearXNG Agent tool allows authenticated users to reach internal network hosts that the platform's own security controls are supposed to block. Affected versions are n8n before 2.34.1 and 2.33.x before 2.33.4 when deployed with N8N_SSRF_PROTECTION_ENABLED=true. An attacker with permission to create SearXNG credentials and configure a personal agent can point the API URL at internal infrastructure - cloud metadata endpoints, internal APIs, or intranet services - and receive responses directly through the agent chat interface. No public exploit or active exploitation (CISA KEV) identified at time of analysis.
Sandbox escape in n8n's JavaScript Code node allows authenticated workflow authors to break out of the Node.js VM sandbox by polluting an unfrozen Function.prototype, ultimately recovering a reference to the host process's globalThis object. Affected are n8n deployments running versions prior to 1.123.69, 2.33.4, and 2.34.1 where users hold workflow creation and execution permissions. Full exploitation also requires that specific Node.js modules are present on the allowlist of the deployment's import configuration, raising practical complexity but making impact highly deployment-dependent. No public exploit code or CISA KEV listing has been identified at time of analysis.
ReDoS in n8n's Filter and Switch nodes allows an authenticated workflow author to monopolize a worker thread indefinitely by supplying a catastrophic backtracking regex compiled via `new RegExp()` without complexity validation or execution timeout. Affected are n8n versions before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1; per-item execution amplifies the impact proportionally to dataset size, stalling all concurrent workflows on the same worker. No public exploit code or CISA KEV listing has been identified at time of analysis.
Credential exfiltration in n8n's GraphQL node allows authenticated workflow authors to bypass per-credential allowed-domains enforcement. When the node's Authentication parameter is set to expression mode and two credentials of different types are attached, the platform enforces the domain restriction of only the first credential while silently forwarding secret material from the second to any destination - including attacker-controlled endpoints. No public exploit has been identified at time of analysis, but the CVSS 4.0 subsequent-system confidentiality impact is rated High, reflecting the downstream value of an exfiltrated credential that may carry permissions well beyond the n8n instance.
Server-side request forgery and MVG code injection in n8n's Edit Image node allows authenticated low-privilege users to issue blind outbound HTTP requests or read local files by injecting ImageMagick MVG primitives into the Draw Text operation. All n8n versions before 1.123.69 are affected, confirmed by vendor advisory GHSA-233r-fpgw-fx8x. No public exploit identified at time of analysis, but the High confidentiality impact in the CVSS 4.0 vector signals meaningful data exfiltration risk for instances co-located with sensitive internal services or cloud metadata endpoints.
Cross-project credential reference injection in n8n before 2.34.1 allows low-privileged attackers holding a valid MCP Bearer API key to bypass authorization controls in the create_workflow_from_code MCP tool and embed references to credentials belonging to other projects into workflows they should not control. The bypass is conditional on the credential authentication type being set to 'expression', at which point n8n fails to enforce project-scoped authorization on credential objects. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 5.3 reflects a realistic, low-complexity network attack by authenticated users.
SSRF protection bypass in n8n's OAuth2 credential token-exchange flow allows authenticated users holding credential-creation permissions to direct n8n's backend to issue HTTP POST requests to arbitrary internal network addresses. Affected deployments span all n8n releases prior to 1.123.69 (v1 branch), 2.33.4 (v2.33 branch), and 2.34.1 (v2.34 branch). While n8n applies SSRF guards to OAuth2 discovery and dynamic-client-registration requests, the access-token exchange step uses a separate, unguarded HTTP client, meaning a malicious credential configuration bypasses those controls entirely and reflects internal service responses back to the attacker. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 base score of 2.3 reflects the constrained impact and privilege requirement.
SQL injection in n8n's PostgresTrigger node enables authenticated users to execute arbitrary SQL against connected PostgreSQL databases with the configured credential's full privileges. Affected versions span the n8n 1.x branch before 1.123.67, the 2.x branch before 2.31.5, and the 2.32.x branch before 2.32.1. Successful exploitation yields unrestricted read and write access to the backend PostgreSQL instance - a scope-change impact confirmed by the CVSS 4.0 SC:H/SI:H/SA:H rating - with no public exploit identified at time of analysis and no CISA KEV listing.
Path traversal in n8n's @n8n/computer-use search_files tool exposes arbitrary local files to any actor who can control the tool's search input. Affected versions span all n8n releases before 2.31.5 and the entire 2.32.x branch before 2.32.1, limited to deployments that run AI agent workflows leveraging the computer-use package. An authenticated low-privileged user can bypass the configured base-directory sandbox and retrieve the names and contents of any file readable by the n8n daemon's OS user account. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Prototype pollution in n8n's VM expression engine enables authenticated workflow editors to escape the sandbox and crash the main n8n process by obtaining a reference to a host built-in and corrupting its prototype. Affected versions span the entire 1.x branch prior to 1.123.67 and two 2.x patch lines (before 2.31.5 and 2.32.1), covering both self-hosted deployments and n8n cloud instances using the VM expression engine. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the sandbox escape primitive is technically significant and poses meaningful risk in multi-tenant or loosely-governed deployments.
SSRF protection bypass in n8n's MCP Client node allows any authenticated user with workflow creation or editing rights to reach internal or blocked hosts and read responses back through the workflow. The MCP Client node neither routes outbound requests through n8n's SSRF protection layer nor pins the resolved IP address after DNS resolution, undermining the platform's intended network isolation guarantees. Vendor-released patches exist in versions 2.31.5 and 2.32.1; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.