36 matches found
ROOT-APP-NPM-CVE-2026-54312 CVE-2026-54312 in n8n - Patched by Root
Root has patched CVE-2026-54312 in the n8n package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-54303 CVE-2026-54303 in n8n - Patched by Root
Root has patched CVE-2026-54303 in the n8n package for Root:npm. Multiple fixed versions available...
MAL-2026-11194 Malicious code in n8n-nodes-trust-me-im-totally-safe (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8bd22982653509931d8154fc00793d03ae037f78243500c749ff4f6c1274e73c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Cross-site Scripting (XSS)
Overview @n8n/n8n-nodes-langchain is a Affected versions of this package are vulnerable to Cross-site Scripting XSS via the webhookId parameter in the Chat Trigger node. An attacker can execute arbitrary JavaScript in the context of another user's session by injecting malicious code, which is the...
n8n Node.js Package < 1.123.48 / 2.x < 2.21.8 / 2.22.x < 2.22.4 Sandbox Escape (CVE-2026-49444)
The version of the n8n Node.js Package installed on the remote host is prior to 1.123.48, or 2.x prior to 2.21.8, or 2.22.x prior to 2.22.4. It is, therefore, affected by a sandbox escape vulnerability: - A vulnerability in the Python sandbox allows authenticated users to escape the sandbox and...
NPM: n8n: Same-Origin XSS in Respond to Webhook Node
NPM: n8n: Same-Origin XSS in Respond to Webhook Node vulnerability discovered by ? in WordPress Npm n8n versions 1.123.55...
ROOT-APP-NPM-CVE-2025-68613 CVE-2025-68613 in @rootio/n8n - Patched by Root
Root has patched CVE-2025-68613 in the @rootio/n8n package for Root:npm. Multiple fixed versions available...
NPM: n8n: HTTP Request Node Pagination Prototype Pollution to RCE
NPM: n8n: HTTP Request Node Pagination Prototype Pollution to RCE vulnerability discovered by ? in WordPress Npm n8n versions 1.123.43...
n8n Node.js Package >= 1.65.0 < 1.114.3 Unsafe Buffer Allocation Memory Disclosure (CVE-2025-61917)
The version of the n8n Node.js Package installed on the remote host is = 1.65.0 and prior to 1.114.3. It is, therefore, affected by an information disclosure vulnerability: - The use of Buffer.allocUnsafe and Buffer.allocUnsafeSlow in the task runner allows untrusted code to allocate uninitialize...
n8n Node.js Package < 1.123.10 / 2.x < 2.5.0 OS Command Injection (CVE-2026-25053)
The version of the n8n Node.js Package installed on the remote host is prior to 1.123.10, or 2.x prior to 2.5.0. It is, therefore, affected by a command injection vulnerability: - Vulnerabilities in the Git node allowed authenticated users with permission to create or modify workflows to execute...
n8n Node.js Package < 1.122.5 / 1.123.x < 1.123.2 Stored XSS (CVE-2026-25051)
The version of the n8n Node.js Package installed on the remote host is prior to 1.122.5, or 1.123.x prior to 1.123.2. It is, therefore, affected by a stored cross-site scripting vulnerability: - A cross-site scripting XSS vulnerability has been identified in the handling of webhook responses and...
n8n Node.js Package < 1.123.12 / 2.x < 2.4.0 Arbitrary File Write via SSH Node (CVE-2026-25055)
The version of the n8n Node.js Package installed on the remote host is prior to 1.123.12, or 2.x prior to 2.4.0. It is, therefore, affected by an arbitrary file write vulnerability: - When workflows process uploaded files and transfer them to remote servers via the SSH node without validating the...
n8n Node.js Package >= 0.187.0 < 1.120.3 Command Injection (CVE-2026-21893)
The version of the n8n Node.js Package installed on the remote host is = 0.187.0 and prior to 1.120.3. It is, therefore, affected by a command injection vulnerability: - A command injection vulnerability was identified in n8n's community package installation functionality. The issue allows...
n8n Node.js Package < 1.121.3 RCE (CVE-2026-21877)
The version of the n8n Node.js Package installed on the remote host is prior to 1.121.3. It is, therefore, affected by a remote code execution vis expression injection vulnerability: - Under certain conditions, an authenticated user may be able to cause untrusted code to be executed by the n8n...
Malicious code in n8n-nodes-hfgjf-irtuinvcm-lasdqewriit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4dabf38b16acea59219df3a3f57a396f3ebe958985096579cd43c419609b764 The package n8n-nodes-hfgjf-irtuinvcm-lasdqewriit was found to contain malicious code. Source: ghsa-malware...
EUVD-2023-1590
Malicious code in bioql PyPI...
EUVD-2023-1511
Malicious code in bioql PyPI...
EUVD-2023-1620
Malicious code in bioql PyPI...
