Skip to content
OpenAdvisories
High NCSC-2026-0049 10 CVEs

Kwetsbaarheden verholpen in n8n

Published Feb 9, 2026 · Updated Feb 9, 2026 · nl

Vendor: n8n Product: n8n

Summary

n8n heeft kwetsbaarheden verholpen in versies 1.114.3, 1.115.0, 1.123.17, 2.5.2, 1.122.5, 1.123.2, 1.123.18, 2.5.0, 1.123.10, 2.5.0, 2.2.1, 1.123.9, 1.123.12, 2.4.0, 1.118.0, 2.4.0, 2.4.8, en 1.120.3.

Details

Interpretaties
De kwetsbaarheden omvatten onder andere het gebruik van `Buffer.allocUnsafe()` en `Buffer.allocUnsafeSlow()`, wat kan leiden tot informatie openbaarmaking. Daarnaast zijn er kwetsbaarheden in de expressie-evaluatiefuncties die geauthenticeerde gebruikers in staat stellen om ongewenste systeemcommando's uit te voeren. Er zijn ook Cross-site Scripting (XSS) kwetsbaarheden ontdekt in de webhook-responsverwerking en de markdown-renderingcomponent, die kunnen leiden tot sessieovername. Verder zijn er kwetsbaarheden in de bestandsaccesscontrols en de Git-node, die het mogelijk maken voor geauthenticeerde gebruikers om gevoelige bestanden te lezen en willekeurige commando's uit te voeren. Een andere kwetsbaarheid stelt ongeauthenticeerde aanvallers in staat om workflows te exploiteren die geüploade bestanden via SSH verwerken, wat kan leiden tot remote code execution. Bovendien is er een kwetsbaarheid in de Merge-node's SQL Query-modus, en in de Python Code-node die het mogelijk maakt om de sandbox-omgeving te ontsnappen. Tot slot is er een command injection-kwetsbaarheid in de community package installatie.

Oplossingen
n8n heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 10

  • Critical 9.4
    CVE-2026-21893

    n8n Vulnerable to Command Injection in Community Package Installation

    n8n is an open source workflow automation platform. From version 0.187.0 to before 1.120.3, a command injection vulnerability was identified in n8n’s community package installation functionality. The issue allowed authenticated users with administrative permi…

    n8n-io n8n n8n npm
  • Critical 9.4
    CVE-2026-25049 Public exploit

    n8n Has an Expression Escape Vulnerability Leading to RCE

    n8n is an open source workflow automation platform. Prior to versions 1.123.17 and 2.5.2, an authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution…

    n8n-io n8n n8n npm
  • Critical 9.4
    CVE-2026-25052

    n8n Improper File Access Controls Allow Arbitrary File Read by Authenticated Users

    n8n is an open source workflow automation platform. Prior to versions 1.123.18 and 2.5.0, a vulnerability in the file access controls allows authenticated users with permission to create or modify workflows to read sensitive files from the n8n host system. Th…

    n8n-io n8n n8n npm
  • Critical 9.4
    CVE-2026-25053 Public exploit

    n8n is Vulnerable to OS Command Injection in Git Node

    n8n is an open source workflow automation platform. Prior to versions 1.123.10 and 2.5.0, vulnerabilities in the Git node allowed authenticated users with permission to create or modify workflows to execute arbitrary system commands or read arbitrary files on…

    n8n-io n8n n8n npm
  • Critical 9.4
    CVE-2026-25056

    n8n Arbitrary File Write leading to RCE in n8n Merge Node

    n8n is an open source workflow automation platform. Prior to versions 1.118.0 and 2.4.0, a vulnerability in the Merge node's SQL Query mode allowed authenticated users with permission to create or modify workflows to write arbitrary files to the n8n server's …

    n8n-io n8n n8n npm
  • Critical 9.4
    CVE-2026-25115

    n8n is vulnerable to Python sandbox escape

    n8n is an open source workflow automation platform. Prior to version 2.4.8, a vulnerability in the Python Code node allows authenticated users to break out of the Python sandbox environment and execute code outside the intended security boundary. This issue h…

    n8n-io n8n n8n npm
  • High 8.5
    CVE-2026-25051

    n8n Improper CSP Enforcement in Webhook Responses May Allow Stored XSS

    n8n is an open source workflow automation platform. Prior to version 1.123.2, a Cross-Site Scripting (XSS) vulnerability has been identified in the handling of webhook responses and related HTTP endpoints. Under certain conditions, the Content Security Policy…

    n8n-io n8n n8n npm
  • High 8.5
    CVE-2026-25054

    n8n is Vulnerable to Stored Cross-Site Scripting via Markdown Rendering in Workflow UI

    n8n is an open source workflow automation platform. Prior to versions 1.123.9 and 2.2.1, a Cross-Site Scripting (XSS) vulnerability existed in a markdown rendering component used in n8n's interface, including workflow sticky notes and other areas that support…

    n8n-io n8n n8n npm
  • High 7.7
    CVE-2025-61917

    n8n Unsafe Buffer Allocation Allows In-Process Memory Disclosure in Task Runner

    n8n is an open source workflow automation platform. From version 1.65.0 to before 1.114.3, the use of Buffer.allocUnsafe() and Buffer.allocUnsafeSlow() in the task runner allowed untrusted code to allocate uninitialized memory. Such uninitialized buffers coul…

    n8n-io n8n n8n npm
  • High 7.1
    CVE-2026-25055

    n8n Arbitrary File Write on Remote Systems via SSH Node

    n8n is an open source workflow automation platform. Prior to versions 1.123.12 and 2.4.0, when workflows process uploaded files and transfer them to remote servers via the SSH node without validating their metadata the vulnerability can lead to files being wr…

    n8n-io n8n n8n npm

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://github.com/advisories/GHSA-49mx-fj45-q3p6
  • Reference
    https://github.com/advisories/GHSA-6cqr-8cfr-67f8
  • Reference
    https://github.com/advisories/GHSA-7c4h-vh2m-743m
  • Reference
    https://github.com/advisories/GHSA-825q-w924-xhgx
  • Reference
    https://github.com/advisories/GHSA-8398-gmmx-564h
  • Reference
    https://github.com/advisories/GHSA-9g95-qf3f-ggrw
  • Reference
    https://github.com/advisories/GHSA-gfvg-qv54-r4pc
  • Reference
    https://github.com/advisories/GHSA-hv53-3329-vmrm
  • Reference
    https://github.com/advisories/GHSA-m82q-59gv-mcr9
  • Reference
    https://github.com/advisories/GHSA-qpq4-pw7f-pp8w