GHSA-2X35-3FW4-9JR4 n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion

Impact The n8n Send Email node did not enforce that its message fields were strings, so a crafted untrusted non-string value from a workflow expression could be treated by the underlying mail library as a file path or URL. This could allow disclosure of local files on the n8n host. Exploitation...

NPM: n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion

NPM: n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion vulnerability discovered by ? in WordPress Npm n8n versions 1.123.67...