Threats affecting pkg:npm/n8n-io/n8n

CVE-2026-21894 is an authentication bypass vulnerability in the n8n workflow automation platform affecting versions 0.150.0 to before 2.2.2. The flaw exists in the Stripe Trigger node, where incoming webhook requests are not verified against the stored Stripe webhook signing secret. This allows unauthenticated attackers who know the webhook URL to send forged Stripe webhook events, triggering workflows without legitimate Stripe events. The risk is somewhat mitigated by the high-entropy UUID in the webhook URL, but authenticated users can view this URL, increasing exposure. Exploitation could lead to fake payment or subscription events influencing downstream processes. The vulnerability has been patched in version 2.

n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker, resulting in exposure of sensitive information stored on the system and may enable further compromise depending on deployment configuration and workflow usage. This issue is fixed in version 1.121.0.

n8n is an open source workflow automation platform. Prior to 1.113.0, a remote code execution vulnerability exists in the Git Node component available in both Cloud and Self-Hosted versions of n8n. When a malicious actor clones a remote repository containing a pre-commit hook, the subsequent use of the Commit operation in the Git Node can inadvertently trigger the hook’s execution. This allows attackers to execute arbitrary code within the n8n environment, potentially compromising the system and any connected credentials or workflows. This vulnerability is fixed in 1.113.0.