Information disclosure

The n8n package 0.218.0 for Node.js allows Information Disclosure...

Directory traversal

The n8n package 0.218.0 for Node.js allows Directory Traversal...

Code injection

The n8n package 0.218.0 for Node.js allows Escalation of Privileges...

n8n 安全漏洞

n8n is a scalable workflow automation tool from n8n open source. A security vulnerability exists in version 0.218.0 of the n8n package for Node.js. An attacker exploited the vulnerability to cause information disclosure...

CVE-2023-27563

The n8n package 0.218.0 for Node.js allows Escalation of Privileges...

CVE-2023-27564

The n8n package 0.218.0 for Node.js allows Information Disclosure...

CVE-2023-27563

The CVE-2023-27563 entry concerns the n8n package 0.218.0 for Node.js. A root cause described in connected sources is a lack of object checks when merging user-supplied fields with the server object in the updateCurrentUser path (MeController), enabling an authenticated user to escalate privilege...

CVE-2023-27563

The n8n package 0.218.0 for Node.js allows Escalation of Privileges...

CVE-2023-27562

The n8n package 0.218.0 for Node.js allows Directory Traversal...

CVE-2023-27562

The CVE-2023-27562 entry concerns the n8n package for Node.js, specifically version 0.218.0, which is vulnerable to Directory Traversal. The root cause is described as improper input validation for the credentialType argument of the getCredentialTranslationPath function, allowing an attacker to d...

CVE-2023-27562

The n8n package 0.218.0 for Node.js allows Directory Traversal...

CVE-2023-27564

The n8n package 0.218.0 for Node.js allows Information Disclosure...

CVE-2023-27563

The n8n package 0.218.0 for Node.js allows Escalation of Privileges...

CVE-2023-27564

The CVE relates to the n8n package for Node.js (versions around 0.216.x–0.218.0) and is an Information Disclosure flaw. A PoC/exploit exists showing anonymous file read. Mitigation varies by source, but PT-Security recommends upgrading to 0.216.1 or later; other advisories reference 0.218.0 as vu...

CVE-2023-27564

The n8n package 0.218.0 for Node.js allows Information Disclosure...

CVE-2023-27562

The n8n package 0.218.0 for Node.js allows Directory Traversal...

Node.js: Permissions policies can be bypassed via process.mainModule

A privilege escalation vulnerability exists in Node.js 19.6.1, 18.14.1, 16.19.1 and 14.21.3 that made it possible to bypass the experimental Permissions https://nodejs.org/api/permissions.html feature in Node.js and access non authorized modules by using process.mainModule.require. This only...

Moderate: Red Hat Security Advisory: nodejs and nodejs-nodemon security, bug fix, and enhancement update

An update for nodejs and nodejs-nodemon is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Node.js: Fetch API did not protect against CRLF injection in host headers

A flaw was found in the fetch API in Node.js that did not prevent CRLF injection in the 'host' header. This issue could allow HTTP response splitting and HTTP header injection...

Node.js: insecure loading of ICU data through ICU_DATA environment variable

An untrusted search path vulnerability exists in Node.js. 19.6.1, 18.14.1, 16.19.1, and 14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges...