CVE-2026-77074: Improper Control of Generation of Code ('Code Injection') in n8n-io n8n

This vulnerability in n8n allows authenticated users to inject MVG primitives via the Edit Image node's Draw Text operation, leading to server-side request forgery. Attackers can craft malicious text values that cause the server to issue blind outbound HTTP requests to arbitrary addresses or access local files. The issue is present in n8n versions prior to 1.123.69, as well as in certain 2.x versions before 2.33.4 and 2.34.1. The CVSS 4.0 score is 6.0, indicating medium severity, with network attack vector, high complexity, and low privileges required.

Exploitation of this vulnerability allows authenticated attackers to perform server-side request forgery, potentially enabling them to make unauthorized HTTP requests from the server to arbitrary external or internal addresses. This can lead to information disclosure such as accessing local files or internal network resources. The impact is limited to authenticated users with low privileges, and the attack complexity is high.

A fix is available in n8n versions 1.123.69, 2.33.4, and 2.34.1 or later. Users should upgrade to these versions to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying the vendor's patches. No vendor advisory content was provided, so check the official n8n release notes or security advisories for confirmation and detailed upgrade instructions.