CVE-2026-86995

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, but setUpstream wrote a branch..remote value into repository configuration without validating it. A later fetch or pull resolved the remote...

CVE-2026-86081

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-controlled destination path against the default N8NBLOCKFILEPATTERNS regular expression. The pattern ^./.git/.$ allowed catastrophic backtracking and ran...

CVE-2026-86079

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could...

CVE-2026-86079

CVE-2026-86079 affects n8n , an open-source workflow automation platform. The Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths without the required toPathSegment encoding (missing in GenericFunctions.ts). An i...

CVE-2026-86079 n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could...

CVE-2026-86079 n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could...

CVE-2026-86081

n8n , an open-source workflow automation platform, is vulnerable to Regular Expression Denial of Service (ReDoS) in its Git node clone operation. Prior to versions 1.123.76 , 2.37.7 , and 2.38.2 , the default N8N_BLOCK_FILE_PATTERNS regex (^(./).git(/.)$) permitted catastrophic backtracking when ...

CVE-2026-86081 n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-controlled destination path against the default N8NBLOCKFILEPATTERNS regular expression. The pattern ^./.git/.$ allowed catastrophic backtracking and ran...

CVE-2026-86081 n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-controlled destination path against the default N8NBLOCKFILEPATTERNS regular expression. The pattern ^./.git/.$ allowed catastrophic backtracking and ran...

CVE-2026-86081 n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-controlled destination path against the default N8NBLOCKFILEPATTERNS regular expression. The pattern ^./.git/.$ allowed catastrophic backtracking and ran...

CVE-2026-86082 n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make t...

CVE-2026-86995

CVE-2026-86995 affects n8n , an open-source workflow automation platform. The Git node validated the repository parameter for fetch/pull operations, but its setUpstream function wrote a branch..remote value into the repository configuration without validation. A subsequent fetch or pull then reso...

CVE-2026-86995 n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, but setUpstream wrote a branch..remote value into repository configuration without validating it. A later fetch or pull resolved the remote...

CVE-2026-86995 n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, but setUpstream wrote a branch..remote value into repository configuration without validating it. A later fetch or pull resolved the remote...

CVE-2026-86995 n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, but setUpstream wrote a branch..remote value into repository configuration without validating it. A later fetch or pull resolved the remote...

node-csv: Prototype replacement still reachable via columns path

Impact With columns: true and groupcolumnsbyname: true, a duplicated proto header causes the duplicate-column branch to assign an array to obj'proto', invoking the proto setter and replacing the parsed record object's prototype with attacker-controlled data. Fixed in 7.0.2 Object.hasOwn duplicate...

EUVD-2026-70737

node-csv: Prototype replacement still reachable via columns path...

GHSA-8CW4-87C7-C6XX node-csv: Prototype replacement still reachable via columns path

Impact With columns: true and groupcolumnsbyname: true, a duplicated proto header causes the duplicate-column branch to assign an array to obj'proto', invoking the proto setter and replacing the parsed record object's prototype with attacker-controlled data. Fixed in 7.0.2 Object.hasOwn duplicate...

NPM: node-csv: Prototype replacement still reachable via columns path

NPM: node-csv: Prototype replacement still reachable via columns path vulnerability discovered by ? in WordPress Npm csv-parse versions 7.0.2...

2broke2wait (0.1.0), @1percentlabs/onenote-mcp (0.2.0) +2882 more potentially affected by CVE-2026-84003 via @azure/msal-node (>=1.0.0-alpha.5, <=5.5.0)

@azure/msal-node NPM version =1.0.0-alpha.5, =1.0.1, =16.0.5-feature-9fd817-lpv4shs1, =0.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2026-84003 Source advisory: MEND:CVE-2026-84003...