CVE-2025-27407

CVE-2025-27407 GitLab Podman Lab Minimal local-only lab for proving the GitLab Direct Transfer HTTP path reaches the vulnerable graphql-ruby introspection schema loader. The lab runs one vulnerable GitLab CE container; the PoC script starts its fake GitLab source server in-process only while...

Directory Traversal

Overview @n8n/workflow-sdk is a TypeScript SDK for programmatically creating n8n workflows Affected versions of this package are vulnerable to Directory Traversal in the node-schema loader of @n8n/workflow-sdk, which builds the path to a node's schema module directly from the caller supplied node...

CVE-2026-77068 n8n before 2.34.1 Remote Code Execution via Path Traversal

n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability in the @n8n/workflow-sdk node-schema loader used for MCP node-schema loading. The loader derives a node's schema module path directly from the attacker-supplied node type string without validating...

PT-2026-78924

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.33.4 n8n versions 2.34.x prior to 2.34.1 Description A remote code execution issue exists in the @n8n/workflow-sdk node-schema loader used for MCP node-schema loading. The loader determines a node's schema module path...

CVE-2026-77068: Improper Limitation of a Pathname to a Restricted Directory

n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability in the @n8n/workflow-sdk node-schema loader used for MCP node-schema loading. The loader derives a node's schema module path directly from the attacker-supplied node type string without validating...

Arbitrary Code Injection

Overview graphql is a plain-Ruby implementation of GraphQL. Affected versions of this package are vulnerable to Arbitrary Code Injection via the GraphQL::Schema.fromintrospection or GraphQL::Schema::Loader.load processes. An attacker can execute arbitrary code by loading a crafted GraphQL schema...