n8n vulnerabilities

The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host system where n8n runs. Attackers with user access or compromised credentials can exploit this node to run malicious commands, potentially leading to data exfiltration, service disruption, or complete system compromise.

A vulnerability in n8n before version 2.25.7 and 2.26.x before 2.26.2 allows bypassing the AST security validator in the Python Code node. An authenticated user with permission to create or modify workflows containing this node can access the task executor module namespace.

n8n contains a stored XSS vulnerability in the Chat Trigger node's Custom CSS field due to a misconfiguration of the sanitize-html library. An authenticated user with permission to create or modify workflows can inject JavaScript that bypasses sanitization, resulting in stored XSS against any user who visits the public chat page.

An authentication bypass vulnerability in n8n before version 2.8.0 allows authenticated SSO users to disable SSO enforcement via the API. Attackers can create local password credentials to authenticate directly, bypassing organizational SSO policies and identity-provider-enforced multi-factor authentication.

n8n is an open source workflow automation platform. Prior to version 2.24.0, an authenticated user with workflow edit access could supply a malicious filter value in the MongoDB node's Find And Replace operation, leading to unintended documents being matched and overwritten with attacker-controlled content.

n8n is a workflow automation platform that prior to version 2.24.0 allowed authenticated users with permissions to create or modify workflows to achieve global prototype pollution via the Microsoft SQL node by supplying a crafted value as the table parameter.

In the n8n workflow automation platform, the SeaTable node's row:search and row:get operations concatenated user-controlled input directly into SQL query strings without escaping or parameterization. In workflows where external user input is passed via expressions into the SeaTable node's search or row retrieval parameters, an attacker could manipulate the constructed query to retrieve unintended rows from the connected SeaTable base, bypassing row-level filtering logic. The issue was patched in versions 1.123.32, 2.17.4, and 2.18.1.

In n8n prior to version 2.0.0, when the Code node runs in legacy (non-task-runner) JavaScript execution mode, authenticated users with workflow editing access can invoke internal helper functions. This allows reading and writing files on the host filesystem with the privileges of the n8n process. The issue is patched in version 2.0.0.

n8n prior to version 1.114.0 has a stored XSS vulnerability in the "Respond to Webhook" node. When the node responds with HTML content containing executable scripts, the payload may execute in the top-level window, outside the sandbox. This allows an attacker with workflow creation permissions to execute arbitrary JavaScript in the context of the n8n editor interface. The issue is patched in version 1.114.0.

n8n versions 0.123.1 through 1.119.1 lack adequate protections to prevent RCE through the project's pre-commit hooks. The Add Config operation allows workflows to set arbitrary Git configuration values, including core.hooksPath, which can point to a malicious Git hook that executes arbitrary commands on the n8n host during subsequent Git operations.

A remote code execution (RCE) vulnerability in the Git Node component of n8n (versions prior to 1.113.0), available in both Cloud and Self-Hosted versions. When a malicious actor clones a remote repository containing a pre-commit hook, subsequent use of the Commit operation in the Git Node can inadvertently trigger the hook's execution. This allows attackers to execute arbitrary code within the n8n environment.

From 1.24.0 to before 1.107.0, there is a stored cross-site scripting (XSS) vulnerability in @n8n/n8n-nodes-langchain.chatTrigger. An authorized user can configure the LangChain Chat Trigger node with malicious JavaScript in the initialMessages field and enable public access so that the payload is executed in the browser of any user who visits the resulting public chat URL.