MAL-2026-11026 Malicious code in ethers-packge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 534b72f9b5ef702509f5868e85ff740c59e1e6c1f871ad0999253a062254aacd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11023 Malicious code in bs58-88 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6d1dec3ae934b73d28ddd4c002cf93f9a9be597731434f5cfead7fdbb11954f Package bs58-88 mimics the popular bs58 base58 encoder: README, keywords, and repository URL match the real bs58, and index.cjs re-exports...

MAL-2026-11021 Malicious code in @bcryptln/bcryptjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d8447904424d1fd6085c58e7a0adec80bad268c96395c885d104ee80da79c2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2026-63960

Name of the Vulnerable Software and Affected Versions JetBrains WebStorm versions prior to 2026.2 Description Arbitrary code execution is possible before granting project trust through the configured Node.js interpreter. Recommendations Update JetBrains WebStorm to version 2026.2...

PT-2026-63972

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.2 Description A cross-site scripting issue exists in the siyuan:// protocol handler. When a link using the format siyuan://plugins/ references a plugin that is not installed, the application opens a custom tab and...

PT-2026-64211

Name of the Vulnerable Software and Affected Versions find-my-way versions prior to 9.7.0 Description A remotely triggerable Denial of Service DoS exists when the software is used with Node's HTTP/2 server. The lookup function passes the req.method variable into the find function, which then...

CVE-2026-16631 publint package-manager pack.js child_process.exec os command injection

A vulnerability was detected in publint up to 0.1.4. This impacts the function childprocess.exec of the file src/node/pack.js of the component package-manager Command Handler. The manipulation results in os command injection. Attacking locally is a requirement. The exploit is now public and may b...

Malicious code in hardhat-gas-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f908ec767bb48d5cf889b1035fc89ff03d0422bfa043e3c361c4faf0002df95 On module load, the package schedules a randomized 5-15 second setTimeout that POSTs a JSON body containing os.hostname, os.userInfo.username,...

n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

Impact The n8n Snowflake node's Execute Query operation interpolated expression values directly into the SQL string, making queries built with untrusted data susceptible to SQL injection. Exploitation requires that a workflow author has already embedded untrusted expression data directly in a raw...

GHSA-652Q-GVQ3-74QV n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

Impact The n8n Snowflake node's Execute Query operation interpolated expression values directly into the SQL string, making queries built with untrusted data susceptible to SQL injection. Exploitation requires that a workflow author has already embedded untrusted expression data directly in a raw...

NPM: n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances

NPM: n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances vulnerability discovered by ? in WordPress Npm n8n versions 1.123.67...

GHSA-JQWR-VX3P-R266 n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances

Impact The Postgres Trigger node interpolated user-supplied identifier parameters channel, function, and trigger names into SQL statements without proper escaping, so an authenticated user could inject arbitrary SQL executed against the connected PostgreSQL database with the configured credential...

GHSA-9CMH-XCQM-5HQR n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner

Impact n8n's JavaScript task runner shared one module cache across all users' Code-node executions, so a user able to run a Code node could poison a cached module and alter other users' Code-node executions on the same runner, affecting their confidentiality, integrity, or availability. This is a...

NPM: Next.js: Unbounded Server Action payload in Edge runtime

NPM: Next.js: Unbounded Server Action payload in Edge runtime vulnerability discovered by ? in WordPress Npm next versions = 13.0.0, 15.5.21...

NPM: n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data

NPM: n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...

n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction

Impact The GraphQL node did not enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials such as Header Auth, Basic Auth, Query Auth, and OAuth, unlike the HTTP Request node. An authenticated user able to create or edit workflows could therefore point the node's endpoint a...

GHSA-GQ66-9CW5-J5JM n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction

Impact The GraphQL node did not enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials such as Header Auth, Basic Auth, Query Auth, and OAuth, unlike the HTTP Request node. An authenticated user able to create or edit workflows could therefore point the node's endpoint a...

Incorrect Authorization

Overview @n8n/n8n-nodes-langchain is a Affected versions of this package are vulnerable to Incorrect Authorization in the OAuth 2.1 authorization. An attacker can gain unauthorized access to another user's workflow and execute it with the owner's credentials by registering an OAuth client and...

EUVD-2026-44634

n8n: External Secrets Accessible via Workflow Expressions Outside Credentials...

External Control of File Name or Path

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to External Control of File Name or Path via the Edit Image. An attacker can write arbitrary files outside the intended directory by supplying crafted values to the output format parameter. Workaround...