Threat database

GitPython versions before 3.2.0 contain a regular expression denial of service (ReDoS) vulnerability in the _re_actor_epoch pattern used during parsing of author, committer, and tagger lines. This flaw allows attackers to cause excessive CPU consumption by serving repositories with commit or tag objects that have long space-filled lines without valid epoch or timezone information, triggering inefficient regex processing.

GitPython versions prior to 3.2.0 contain an information disclosure vulnerability. This flaw allows maliciously crafted repositories to exploit environment variable expansion in the cloning process, specifically via the separate_git_dir parameter in Repo._clone(). Attackers can use specially named submodules with variable syntax to expose sensitive information from .git/modules directory names and DEBUG logs during clone and submodule update operations.

Parse Server versions before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 have a vulnerability where errors during sending verification or password reset emails are not handled properly, causing the server process to exit. This can be triggered by a client using only public application keys when the mail provider rejects, rate limits, or is unavailable.

n8n versions before 1.123.83 have an authorization bypass vulnerability that allows authenticated users to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. This enables attackers to access credentials from projects they do not belong to and modify static data and error-workflow dispatch of other workflows.

n8n versions before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contain an authentication bypass vulnerability. This occurs because dynamic-path webhook resolution only matched requests based on the path, ignoring the server-generated unguessable identifier in the URL. As a result, unauthenticated attackers can omit this identifier and execute workflows in unrelated projects using those projects' credentials.

n8n versions before 2.41.4 and certain 2.42.x versions before 2.42.1 contain an authorization bypass vulnerability in the Agents create endpoint. This flaw allows an authenticated user with read-only Agent access to one project to supply an existing Agent ID and move that Agent into their own project, enabling them to modify the Agent's name, schema, and version without proper ownership verification.

n8n versions before 2.41.4 and versions 2.42.0 before 2.42.1 contain an incorrect authorization vulnerability. The software does not properly validate credential IDs stored in agent node parameters when an editor saves a shared workflow. This allows an editor to configure a Message an Agent node in inline mode to access the owner's credentials and potentially send decrypted secrets to an attacker-controlled destination.

CVE-2026-110849 is a stored cross-site scripting (XSS) vulnerability in n8n versions before 1.123.83, 2.41.4, and 2.42.1. It occurs in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. An attacker who uploads a crafted item can execute scripts in the context of the n8n origin for users who preview the item, potentially acting with their session privileges.

n8n versions before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contain a prototype pollution vulnerability in the AI workflow builder. Authenticated users can create nodes named __proto__ via the API and connect them, causing pollution of the global object prototype. This disrupts the n8n instance until it is restarted.

CVE-2026-110847 is a stored cross-site scripting (XSS) vulnerability in n8n versions before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1. The flaw exists in the Chat Trigger hosted-chat page where insufficient sanitization of customCss values allows malicious markup injection. This enables workflow authors to publish chats without requiring n8n user authentication, potentially executing scripts in the context of signed-in visitors' sessions.

n8n versions before 2.41.4 and 2.42.x before 2.42.1 contain a signature validation bypass in the waiting-webhook endpoint. This flaw arises because validation occurs before canonicalization of an alternate node reference form, allowing attackers with a workflow execution's resume token to approve waiting executions intended for others. This can lead to unauthorized downstream actions running under the workflow owner's credentials, potentially including command execution.

CVE-2026-110845 is a high-severity code execution vulnerability in the n8n automation tool affecting versions before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1. The flaw exists in the Git node Log operation, which does not properly strip a repository's local git configuration before running an external program. Authenticated users with permission to configure the node can exploit this to execute arbitrary code as the n8n process user.

n8n versions before 1.123.83 have an authorization bypass vulnerability allowing shared-workflow editors to access restricted credentials by embedding them in nested or inline sub-workflows. This flaw permits attackers with editor privileges to save workflows that reference credentials they should not access, which then execute using the workflow owner's credential values.

n8n versions before 2.41.4 and 2.42.x before 2.42.1 have a vulnerability in the unauthenticated OAuth authorize endpoint that allows attackers to create unlimited client records by manipulating query strings. This leads to uncontrolled resource consumption and can fill the disk.

n8n versions before 2.41.4 and 2.42.x before 2.42.1 have a prototype pollution vulnerability in the MCP workflow-validation tool. This flaw allows an authenticated user with only workflow:read permission to manipulate shared prototypes, bypassing server-side permission checks and potentially taking over owner accounts without MFA protection.

n8n versions before 2.41.4 and 2.42.0 contain an authorization bypass vulnerability in the agent chat resume endpoint. This flaw allows authenticated project members to access and manipulate other members' private agent conversations by providing a run identifier without proper ownership verification. Exploitation can lead to unauthorized reading of private conversations and execution of tool calls within the victim's context.

An SQL injection vulnerability exists in n8n versions before 2.41.4 and in 2.42.x before 2.42.1 within the Microsoft SQL node version 1. This flaw allows unauthenticated external users to execute arbitrary SQL commands on the connected database by injecting malicious input into the Query field, which is not properly parameterized. The attack leverages untrusted input such as webhook fields bound to the Query field, potentially granting access with the stored credential's privileges.

This report compares browser environment signals from two AI agents, Muse AI and Grok Bot, tested against an instrumented website login flow. Both agents exhibited similar browser and infrastructure characteristics, such as operating system, browser version, and GPU rendering method, with some differences in processor count and screen resolution. Grok Bot traffic did not consistently originate from the same IP range, making IP-based identification less reliable. The analysis highlights the challenge of distinguishing AI agents from legitimate users based solely on infrastructure signals and notes that as AI agents run more locally, such signals may become less effective. The observations are specific to the tested sessions and do not represent universal traits of these agents.

CVE-2026-107795 is a high-severity vulnerability in TP-Link Omada Software Controller versions prior to 6.3.0.45. It involves missing authorization checks in the MSP and OpenAPI certificate/private-key management APIs, allowing authenticated users with low privileges to perform privileged certificate management operations. Exploitation could enable such users to upload or delete TLS certificates or private keys, potentially disrupting secure management access.

A vulnerability in the ljharb qs library versions 6.7.0 through 6.16.0 causes a TypeError when qs.stringify is called with arrayFormat 'comma' on arrays containing elements that cannot be coerced to strings. This uncaught exception can cause synchronous throws leading to HTTP 500 errors or, in some cases, process crashes due to unhandled promise rejections. The issue was fixed in version 6.16.1.