@dataform/cli (>=3.0.57, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +22 more potentially affected by CVE-2026-92953 via vm2 (>=3.11.1, <=3.11.6)

vm2 NPM version =3.11.1, =3.0.57, =0.1.0, =2.32.0, =0.0.16, =1.4.13, =1.0.0, =1.1.0, =0.2.0, =1.0.0, =3.1.3, =2.32.0, =1.72.3, =2.0.9 and more Source cves: CVE-2026-92953 Source advisory: OSV:GHSA-3VGF-8M4Q-Q4QR...

@dataform/cli (>=3.0.57, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +22 more potentially affected by CVE-2026-92936 via vm2 (>=3.11.1, <=3.11.6)

vm2 NPM version =3.11.1, =3.0.57, =0.1.0, =2.32.0, =0.0.16, =1.4.13, =1.0.0, =1.1.0, =0.2.0, =1.0.0, =3.1.3, =2.32.0, =1.72.3, =2.0.9 and more Source cves: CVE-2026-92936 Source advisory: OSV:GHSA-X6M4-CHR9-CG97...

@n8n/n8n-nodes-langchain (>=2.32.0, <=2.34.0) potentially affected by CVE-2026-77069 via n8n-nodes-base (>=2.32.0, <=2.34.0)

n8n-nodes-base NPM version =2.32.0, =2.32.0, =2.34.0 Source cves: CVE-2026-77069 Source advisory: SNYK:JS-N8NNODESBASE-20054036...

Server-side Request Forgery (SSRF)

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the OAuth2 authorization-code-to-access-token exchange, which issues its request through a separate HTTP client that lacks the SSRF guard applied to the discovery...

@n8n/n8n-nodes-langchain (>=2.32.0, <=2.33.1) potentially affected by CVE-2026-77076 via n8n-nodes-base (>=2.32.0, <=2.33.0)

n8n-nodes-base NPM version =2.32.0, =2.32.0, =2.33.1 Source cves: CVE-2026-77076 Source advisory: SNYK:JS-N8NNODESBASE-20186635...

@n8n/n8n-nodes-langchain (2.34.0) potentially affected by CVE-2026-77076 via n8n-nodes-base (2.34.0)

n8n-nodes-base NPM version 2.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on n8n-nodes-base and may be impacted: - @n8n/n8n-nodes-langchain 2.34.0 Source cves: CVE-2026-77076 Source advisory: SNYK:JS-N8NNODESBASE-20186635...

Insertion of Sensitive Information into Log File

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the GraphQL node's error handling, which re-throws the underlying HTTP client error unchanged on a connection level failure rather than wrapping i...

@n8n/n8n-nodes-langchain (>=2.32.0, <=2.33.1) potentially affected by CVE-2026-77081 via n8n-nodes-base (>=2.32.0, <=2.33.0)

n8n-nodes-base NPM version =2.32.0, =2.32.0, =2.33.1 Source cves: CVE-2026-77081 Source advisory: SNYK:JS-N8NNODESBASE-20186634...

@n8n/n8n-nodes-langchain (2.34.0) potentially affected by CVE-2026-77081 via n8n-nodes-base (2.34.0)

n8n-nodes-base NPM version 2.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on n8n-nodes-base and may be impacted: - @n8n/n8n-nodes-langchain 2.34.0 Source cves: CVE-2026-77081 Source advisory: SNYK:JS-N8NNODESBASE-20186634...

Authorization Bypass Through User-Controlled Key

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the GraphQL node's Authentication parameter, which accepts expression values and, when several credentials of different types are attached in...

@n8n/n8n-nodes-langchain (2.32.0) potentially affected by unknown CVE via n8n-nodes-base (2.32.0)

n8n-nodes-base NPM version 2.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on n8n-nodes-base and may be impacted: - @n8n/n8n-nodes-langchain 2.32.0 Source cves: unknown CVE Source advisory: SNYK:JS-N8NNODESBASE-18322069...

SQL Injection

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to SQL Injection in the executeQuery. An attacker can execute arbitrary SQL commands by injecting untrusted expression data directly into a raw SQL query string. Note: This is only exploitable if a...

@n8n/n8n-nodes-langchain (2.32.0) potentially affected by unknown CVE via n8n-nodes-base (2.32.0)

n8n-nodes-base NPM version 2.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on n8n-nodes-base and may be impacted: - @n8n/n8n-nodes-langchain 2.32.0 Source cves: unknown CVE Source advisory: SNYK:JS-N8NNODESBASE-18322068...

SQL Injection

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to SQL Injection via the PostgresTrigger. An attacker can execute arbitrary SQL commands on the connected PostgreSQL database by supplying crafted input to identifier parameters, leading to full read a...

@n8n/n8n-nodes-langchain (2.32.0) potentially affected by unknown CVE via n8n-nodes-base (2.32.0)

n8n-nodes-base NPM version 2.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on n8n-nodes-base and may be impacted: - @n8n/n8n-nodes-langchain 2.32.0 Source cves: unknown CVE Source advisory: SNYK:JS-N8NNODESBASE-18323908...

Prototype Pollution

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Prototype Pollution via the Edit Fields Set process when output fields are assigned using dot-notation path setters without restricting field names. An attacker can corrupt a shared global in the ma...

@n8n/n8n-nodes-langchain (2.32.0) potentially affected by unknown CVE via n8n-nodes-base (2.32.0)

n8n-nodes-base NPM version 2.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on n8n-nodes-base and may be impacted: - @n8n/n8n-nodes-langchain 2.32.0 Source cves: unknown CVE Source advisory: SNYK:JS-N8NNODESBASE-18323973...

@n8n/n8n-nodes-langchain (2.32.0) potentially affected by unknown CVE via n8n-nodes-base (2.32.0)

n8n-nodes-base NPM version 2.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on n8n-nodes-base and may be impacted: - @n8n/n8n-nodes-langchain 2.32.0 Source cves: unknown CVE Source advisory: SNYK:JS-N8NNODESBASE-18322078...

Command Injection

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Command Injection via the Git node. An attacker can execute arbitrary commands as the application process user by crafting a local repository to trigger git hooks during workflow execution. Note: Th...

@n8n/n8n-nodes-langchain (2.32.0) potentially affected by unknown CVE via n8n-nodes-base (2.32.0)

n8n-nodes-base NPM version 2.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on n8n-nodes-base and may be impacted: - @n8n/n8n-nodes-langchain 2.32.0 Source cves: unknown CVE Source advisory: SNYK:JS-N8NNODESBASE-18322072...