EUVD-2026-63264

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resource-locator field link preview rendering. The editor spliced the field's stored value directly into the node type's URL template without checking for expression syntax. An...

CVE-2026-77072 n8n before 1.123.69 Stored XSS via Form Completion Page

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completion page. The completion page applied its sandboxing Content-Security-Policy only when respondWith was not set to 'redirect', but responseText was always rendered as raw HTML. An...

CVE-2026-77072 n8n before 1.123.69 Stored XSS via Form Completion Page

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completion page. The completion page applied its sandboxing Content-Security-Policy only when respondWith was not set to 'redirect', but responseText was always rendered as raw HTML. An...

EUVD-2026-63261

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completion page. The completion page applied its sandboxing Content-Security-Policy only when respondWith was not set to 'redirect', but responseText was always rendered as raw HTML. An...

ProtOSINT — Updated!

ProtOSINT ProtOSINT is a Python script that helps you investigate Proton Mail accounts. Version This is ProtOSINT v2. The first version has been around for a few years, but Proton's API changed and the old checks stopped working, so this is a rewrite that brings the tool back to life. Big thanks ...

Malicious code in arone (crates.io)

arone is a malicious crate published to crates.io as part of the coordinated build-time payload campaign on 2026-08-20 that trojanized arrayref, internment, and append-only-vec and published the proc-macro1 typosquat of proc-macro2. It was used as an attacker-controlled dependency carrying a...

PT-2026-83617

A new version of the append-only-vec crate was published with a direct dependency on proc-macro1, which would execute a malicious build script. The compromised version of this crate was published on 2026-08-20, and was removed approximately 107 minutes later. The compromised crate version was use...

PT-2026-83614

We identified that arone contained malicious code executed through a build script. This crate had 7 versions, with the most recent one being published at 2026-08-18. The crate was removed from crates.io on 2026-08-20 and the user account was locked. This crate was used as part of a malware campai...

PT-2026-83621

A new version of the internment crate was published with a direct dependency on proc-macro1, which would execute a malicious build script. The compromised version of this crate was published on 2026-08-20, and was removed approximately 90 minutes later. The compromised version was used as part of...

Malicious code in aronenao (crates.io)

aronenao is a malicious crate published to crates.io as part of the coordinated build-time payload campaign on 2026-08-20 that trojanized arrayref, internment, and append-only-vec and published the proc-macro1 typosquat of proc-macro2. It was used as an attacker-controlled dependency carrying a...

Malicious code in arrayref (crates.io)

arrayref 0.3.10 was published to crates.io from a maintainer account droundy that appears to be compromised. Unlike every prior release, 0.3.10 declares a dependency on the malicious crate proc-macro1. The arrayref source itself is unchanged genuine macro code, but Cargo compiles the declared...

Malicious code in append_only_vec (crates.io)

append-only-vec 0.1.9 was published to crates.io from the same maintainer account droundy as the trojanized arrayref and internment releases, which appears to be compromised. The release adds a dependency on an attacker-controlled crate whose build script downloads and executes an...

Malicious code in proc_macro1 (crates.io)

proc-macro1 is a typosquat of proc-macro2 published to crates.io by the account 'dtolney', impersonating David Tolnay dtolnay. Its metadata forges authors 'David Tolnay ' and points repository at a nonexistent github.com/dtolnay/proc-macro1. The library source is a copy of proc-macro2 so dependen...

Malicious code in internment (crates.io)

internment 0.8.7 was published to crates.io from the same maintainer account droundy as the trojanized arrayref and append-only-vec releases, which appears to be compromised. The release adds a dependency on an attacker-controlled crate whose build script downloads and executes an...

MAL-2026-14336 Malicious code in arrayref (crates.io)

arrayref 0.3.10 was published to crates.io from a maintainer account droundy that appears to be compromised. Unlike every prior release, 0.3.10 declares a dependency on the malicious crate proc-macro1. The arrayref source itself is unchanged genuine macro code, but Cargo compiles the declared...

MAL-2026-14339 Malicious code in proc_macro_en (crates.io)

proc-macro-en is a malicious crate published to crates.io as part of the coordinated build-time payload campaign on 2026-08-20 that trojanized arrayref, internment, and append-only-vec and published the proc-macro1 typosquat of proc-macro2. It was used as an attacker-controlled dependency carryin...

MAL-2026-14340 Malicious code in tinymember (crates.io)

tinymember is a malicious crate published to crates.io as part of the coordinated build-time payload campaign on 2026-08-20 that trojanized arrayref, internment, and append-only-vec and published the proc-macro1 typosquat of proc-macro2. It was used as an attacker-controlled dependency carrying a...

MAL-2026-14337 Malicious code in internment (crates.io)

internment 0.8.7 was published to crates.io from the same maintainer account droundy as the trojanized arrayref and append-only-vec releases, which appears to be compromised. The release adds a dependency on an attacker-controlled crate whose build script downloads and executes an...

PT-2026-83620

It was reported proc-macro1 contained a build script that would download a malicious payload. This crate had two versions, both published on 2026-08-20. The crate was removed from crates.io and related user accounts were locked. This crate was used as part of a malware campaign targeted at users ...

PT-2026-78928

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions prior to 2.33.4 n8n versions prior to 2.34.1 Description A stored cross-site scripting issue exists in the Form node completion page. The system only applied its sandboxing Content-Security-Policy a...