NPM: n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool

NPM: n8n: AI Agents Project Viewer Privilege Escalation via runnodetool vulnerability discovered by ? in WordPress Npm n8n versions 2.29.8...

EUVD-2026-47641

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor...

Cross-site Scripting (XSS)

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Cross-site Scripting XSS n the credential management flow, where the Authorization URL field of an OAuth2 credential accepts a javascript: URL that is not sanitized before being wired to the OAuth...

CVE-2026-56351

n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that allows authenticated users to inject arbitrary SQL through unescaped identifier values in node configuration parameters. Attackers with workflow creation permissions can supply...

CVE-2026-25051

creationtimestamp| type| source ---|---|--- 2026-02-05 08:08:06+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-n8n-1...

n8n 访问控制错误漏洞

n8n is a scalable workflow automation tool from n8n open source. An access control error vulnerability exists in n8n versions 1.36.0 through prior to 2.2.0, which stems from the IP whitelist validation of the Webhook node performing partial string matches instead of exact IP comparisons, which...

n8n 安全漏洞

n8n is a scalable workflow automation tool from n8n open source. A security vulnerability exists in versions prior to n8n 1.113.0 that originates when the Git Node component triggers execution when cloning remote repositories containing pre-commit hooks, which could lead to remote code execution...