CVE Vulnerability Catalog

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8N_SSRF_PROTECTION_ENABLED=true, an authenticated user with permission to create SearXNG credentials and configure a personal agent could set the API URL to an internal host, causing the n8n server to connect to that host and return the response content through the Agent chat output.

n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node execution and recover a reference to the host's globalThis, resulting in a sandbox escape. The full exploit chain additionally depends on specific modules being available as allowlisted imports in the deployment's configuration. The issue is fixed in versions 1.123.69, 2.33.4, and 2.34.1.

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp() and execute them synchronously on the worker thread without complexity validation or execution timeout. A crafted regex pattern can block the worker for an extended period per data item processed, delaying other workflow executions on the same worker.

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error unchanged instead of wrapping it in n8n's standard error type. That error contains the live request's headers, including a decrypted credential secret, which the execution engine persists verbatim. Any authenticated user able to read the resulting execution can retrieve the decrypted credential secret from the stored run data.

n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users to inject MVG primitives. Attackers can craft malicious text values to issue blind outbound HTTP requests to arbitrary addresses or access local files.

n8n versions before 2.34.1 contain a credential validation bypass in the MCP create_workflow_from_code tool when authentication type is set to an expression. Attackers with a valid MCP Bearer API key and knowledge of a target credential ID can persist unauthorized cross-project credential references on workflows in different projects.

A vulnerability in n8n before 1.123.69, 2.33.4, and 2.34.1 is an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. The token exchange uses a separate HTTP client without SSRF guard, allowing a user with credential-creation permissions to set the access-token URL to an internal address and complete the OAuth2 flow, causing n8n to send a token-exchange POST to that target and reflect the response back to the attacker.

Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.

Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.

Subscriber Cross Site Scripting (XSS) in Media Library Assistant <= 3.39 versions.

Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions.

Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.

HCL IntelliOps Event Management (IEM) is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing.

Unauthenticated Broken Access Control in Altair <= 5.2.2 versions.

The setWebhookResolver in the application (likely n8n) lacks validation of user-supplied URLs. An authenticated user can make the server send repeated requests to internal endpoints, including link-local metadata addresses. The response is not returned via the API, making the attack blind.

The scanFeedsResolver in the application (likely n8n) lacks URL validation, allowing an authenticated user to direct the server to arbitrary internal endpoints. The response is parsed as an RSS/Atom feed or HTML, limiting disclosure to feed metadata and RSS/Atom links, but allows distinguishing reachable ports from unreachable ones.

Convert Forms extension for Joomla (versions 1.0.0-4.4.16 and 5.0.0-5.2.5) contains a client-controlled validation bypass vulnerability. CAPTCHA and field validation can be bypassed.

The ipa-enrollment SLAPI plugin in FreeIPA has a null pointer dereference vulnerability. A remote authenticated client can send a malformed LDAP extended operation, omitting the request value for JOIN_OID, causing a server crash and denial of service.

FreeIPA has a vulnerability due to lack of size limits for OTP key values. A low-privilege authenticated user can submit an oversized OTP key, causing excessive CPU and memory consumption, leading to denial of service.

In libsoup, in SoupServer's HTTP Range header processing, the sort_ranges() comparator truncates a 64-bit subtraction result to 32-bit int, causing incorrect sorting for ranges on files larger than ~2 GB. This leads to omission of requested ranges in HTTP 206 Partial Content responses.