n8n vulnerabilities (npm)
157 vulnerabilities.
n8nnpmn8n Vulnerable to LDAP Filter Injection in LDAP Node6.3 Mediumn8nnpmn8n Vulnerable to XSS via Binary Data Inline HTML Rendering6.3 Mediumn8nnpmn8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no6.3 Mediumn8nnpmn8n Has External Secrets Authorization Bypass in Credential Saving7.3 Highn8nnpmn8n Has Authorization Bypass in OAuth Callback via N8N_SKIP_AUTH_ON_OAUTH_CALLBACK6.3 Mediumn8nnpmn8n Vulnerable to SQL Injection in Data Table Node via orderByColumn Expression8.7 Highn8nnpmn8n Vulnerable to Prototype Pollution in XML & GSuiteAdmin node parameters lead to RCE9.4 Criticaln8nnpmn8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account Takeover8.8 Highn8nnpmn8n Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition8.5 Highn8nnpmn8n Has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode9.4 Criticaln8nnpmn8n has In-Process Memory Disclosure in its Task Runner7.1 Highn8nnpmn8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger6.3 Mediumn8nnpmn8n - Guardrail Node Bypass via Crafted Input6.3 Mediumn8nnpmn8n - Authentication Bypass in Chat Trigger Node6.3 Mediumn8nnpmn8n - SSO Enforcement Bypass via API6.0 Mediumn8nnpmn8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Trigger6.3 Mediumn8nnpmn8n - SQL Injection in MySQL, PostgreSQL, and Microsoft SQL Nodes5.3 Mediumn8nnpmn8n Vulnerable to Stored XSS via Various Nodes8.5 Highn8nnpmn8n: Expression Sandbox Escape Leads to RCE9.4 Criticaln8nnpmn8n has Arbitrary Command Execution via File Write and Git Operations9.0 Criticaln8nnpmn8n has Potential Remote Code Execution via Merge Node9.4 Criticaln8nnpmn8n has a Sandbox Escape in its JavaScript Task Runner9.4 Criticaln8nnpmn8n has Arbitrary File Read via Python Code Node Sandbox Escape7.1 Highn8nnpmn8n has Unauthenticated Expression Evaluation via Form Node9.5 Criticaln8nnpmDomain allowlist bypass enables credential exfiltration5.3 Mediumn8nnpmn8n Vulnerable to Command Injection in Community Package Installation9.4 Criticaln8nnpmn8n is vulnerable to Python sandbox escape9.4 Criticaln8nnpmn8n Arbitrary File Write leading to RCE in n8n Merge Node9.4 Criticaln8nnpmn8n Arbitrary File Write on Remote Systems via SSH Node7.1 Highn8nnpmn8n is Vulnerable to Stored Cross-Site Scripting via Markdown Rendering in Workflow UI8.5 Highn8nnpmn8n is Vulnerable to OS Command Injection in Git Node9.4 Criticaln8nnpmn8n Improper File Access Controls Allow Arbitrary File Read by Authenticated Users9.4 Criticaln8nnpmn8n Improper CSP Enforcement in Webhook Responses May Allow Stored XSS8.5 Highn8nnpmn8n Unsafe Buffer Allocation Allows In-Process Memory Disclosure in Task Runner7.7 Highn8nnpmn8n Has an Expression Escape Vulnerability Leading to RCE9.4 Criticaln8nnpmAuthenticated users can bypass the Expression sandbox mechanism to achieve full remote code execution on n8n’s main node.9.9 Criticaln8nnpmn8n has a Webhook Node IP Whitelist Bypass via Partial String Matching5.3 Mediumn8nnpmn8n's Missing Stripe-Signature Verification Allows Unauthenticated Forged Webhooks6.5 Mediumn8nnpmn8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling10.0 Criticaln8nnpmn8n is vulnerable to Remote Code Execution via Arbitrary File Write10.0 Criticaln8nnpmSelf-hosted n8n has Legacy Code node that enables arbitrary file read/write7.1 Highn8nnpmn8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node9.9 Criticaln8nnpmn8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe Sandbox7.3 Highn8nnpmn8n Vulnerable to Remote Code Execution via Expression Injection10.0 Criticaln8nnpmn8n Vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook9.4 Criticaln8nnpmn8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook8.8 Highn8nnpmn8n - Arbitrary Command Execution via Execute Command Node8.7 Highn8nnpmn8n stored cross-site scripting in LangChain Chat Trigger node initialMessages parameter5.4 Mediumn8nnpmn8n has a symlink traversal vulnerability in "Read/Write File" node allows access to restricted files6.5 Mediumn8nnpmStored XSS in n8n Form Trigger allows Account Takeover via injected iframe and video/source8.7 High- Show moreLoading…