CVE Vulnerability Catalog

n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to an error workflow they own, inherit the colleague's identity when that workflow fails, and resolve the colleague's per-user dynamic credential secrets.

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in the Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes. Users who can view a workflow's executions but cannot read the credential can recover Git passwords or tokens, MongoDB database passwords, or Google access tokens from that data.

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline JSON mode that skip the permission check and send decrypted credentials to attacker-controlled servers.

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which build $filter string literals from expression-bindable parameters without escaping. Attackers who supply untrusted input to such workflows can inject single quotes to dump the bound mailbox's entire contact list or redirect SharePoint writes onto unintended list items within the stored credential's scope.

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass in Chat Hub. Users with the global:chatUser role can register restricted tool types and run them via chat to execute sandboxed code, access permitted files, and use instance workflows, Data Tables, and agents.

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and the patch must be installed manually.

Echo, a Go web framework, from 5.0.0 until 5.4.1 has a vulnerability in ExtractIPFromRealIPHeader that validates the client-supplied X-Real-IP value instead of the direct network peer. A client can supply a loopback or private address and have Context.RealIP return that spoofed identity.

In the Echo Go web framework from 4.0.0 until 4.16.1 and in 5.4.1, the Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream, bypassing Echo's router and route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes.

Echo, a Go web framework, from 5.0.0 until 5.4.1 has a vulnerability in BodyDump middleware that can discard a BodyLimit overflow error for an unknown-length request when BodyDump's capture limit is below the BodyLimit threshold. An HTTP/1.1 chunked request can be truncated and processed successfully despite exceeding the configured limit.

Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1.

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it, consuming excessive memory or CPU and allowing repeated or concurrent requests to cause denial of service. The middleware is not enabled by default, and limiting only the compressed request size does not bound the decoded size. This issue is fixed in 4.16.1.

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete response bodies for the dump callback without capture limits. An unauthenticated client that can reach a route using BodyDump can submit large bodies or influence large responses, causing repeated or concurrent allocations that exhaust process memory. BodyDump is not enabled by default, and external request limits may reduce request-side exposure but do not bound response capture. This issue is fixed in 4.16.1.

opentelemetry-java before 1.67.0 has a vulnerability in W3CTraceContextPropagator.extract() where regex delimiter processing can exhibit quadratic backtracking when parsing tracestate headers with long runs of spaces or tabs without a following comma. An unauthenticated attacker can block request threads and cause excessive CPU consumption.

i18next-http-backend prior to 4.0.4 has interpolateUrl inserting unencoded language and namespace values into loadPath or addPath templates without rejecting &, =, or ; query separators. When a template places lng or ns in the query string and an attacker controls that value, the attacker can add or override parameters on translation requests, potentially exposing other namespaces or tenants. This is an incomplete fix for CVE-2026-41691, fixed in 4.0.4.

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.

Vue I18n from 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, when escapeParameter (escapeParameterHtml in Legacy API) is enabled, does not escape named interpolation values if the same translation call supplies both list and named values because escapeParams() processes only the list branch. Applications rendering translations as HTML with untrusted named values and a list can insert attacker-controlled markup, including phishing links, forms, and layout changes, and may allow script execution when combined with the srcdoc sanitizer bypass or on releases without the sanitizer. Fixed in 11.4.14 and 12.0.0-alpha.5.

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid applies credits.href to the credits link without validating the URL scheme. An attacker who controls Grid configuration can provide a javascript URL, and activating the credits link runs script in the origin of the hosting page with access to that application's data and session state. This issue is fixed in Grid Pro 3.2.0.

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the hosting page origin when pagination controls render. Exploitation requires pagination to be enabled but does not require additional user interaction. This issue is fixed in 3.2.0.

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit mode parses fullscreen language labels as HTML rather than inserting them as text. An attacker who controls Dashboards language options can supply markup with event handlers, which execute in the hosting page origin when the fullscreen control is rendered. The label is reachable only when edit mode is enabled and viewFullscreen is present in the context-menu items. This issue is fixed in 4.2.3.

In Highcharts Dashboards, the edit-mode sidebar parses component language strings as HTML rather than inserting them as text. An attacker controlling the Dashboards language configuration can supply markup with event handlers that execute in the hosting page origin when the sidebar is opened. This is fixed in 4.2.3.