A prototype pollution vulnerability in the xml2js library used by n8n's webhook XML body parser allows an authenticated user with workflow modification permissions to achieve remote code execution (RCE) on the n8n host. The flaw is fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1. Until patched, restricting workflow creation and editing to trusted users can serve as a temporary mitigation.
n8n contains a cross-site scripting (XSS) vulnerability via the MCP OAuth client registration process. An unauthenticated attacker can register a malicious OAuth client with a crafted client_name. If a user authorizes this client and another user later revokes access, a toast notification renders the injected script, leading to arbitrary JavaScript execution in the victim's authenticated session. This can result in credential theft, session token compromise, workflow manipulation, or privilege escalation. The vulnerability is fixed in n8n version 1.123.32, 2.17.4, and 2.18.1. Temporary mitigations include restricting access to the MCP OAuth registration endpoint and disabling MCP server functionality if not needed.
A vulnerability in n8n's dynamic-node-parameters endpoints allowed authenticated users with access to shared workflows to bypass credential authorization. By supplying a foreign credential ID, an attacker could cause the backend to use another user's API key to authenticate against attacker-controlled infrastructure, effectively exfiltrating reusable API keys. This affects any node resolving credentials dynamically through these endpoints. The issue is fixed in n8n version 2.18.0 and later.
An authenticated user with permission to create or modify workflows containing a Python Code Node in n8n can escape the sandbox and execute arbitrary code on the task runner container. This vulnerability affects only instances where the Python Task Runner is enabled. The issue is fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1. Temporary mitigations include restricting workflow editing permissions to trusted users and disabling the Python Code node or the Python Task Runner. These mitigations do not fully eliminate the risk and upgrading is recommended.
An authorization bypass vulnerability in n8n's public API variables endpoint allows an authenticated user with a scoped API key to read variables from projects they do not belong to. This affects licensed enterprise or team deployments with multiple projects and the variables feature enabled. The flaw is fixed in versions 1.123.32, 2.17.4, and 2.18.1. Users should upgrade to these versions or later. Temporary mitigations include restricting API key issuance to trusted users and rotating any exposed secrets.
n8n versions prior to 1.123.32, 2.17.4, and 2.18.1 are vulnerable to an unauthenticated denial of service via the MCP OAuth client registration endpoint. This endpoint accepted unauthenticated requests and stored client data without adequate resource controls, allowing an attacker to exhaust server memory by sending large registration payloads. The vulnerability exists regardless of whether MCP access is enabled on the instance. Patches are available in versions 1.123.32, 2.17.4, and 2.18.1. Temporary mitigations include restricting network access and reducing maximum payload size.
A vulnerability in n8n's Hosted Chat feature allows unauthenticated remote attackers to hijack chat executions via the /chat WebSocket endpoint. Attackers who identify a valid execution ID for a workflow in a waiting state can intercept prompts and submit arbitrary input to influence workflow behavior. This affects instances with public Hosted Chat workflows configured with no authentication. The issue is fixed in versions 1.123.32, 2.17.4, and 2.18.1. Temporary mitigation includes enabling authentication on Chat Trigger nodes.
A SQL injection vulnerability exists in the SeaTable node of n8n in the `row:search` and `row:get` operations. This flaw allows user-controlled input to be concatenated directly into SQL queries without proper escaping or parameterization. Exploitation requires a workflow configuration where external user input is passed via expressions into the SeaTable node's search or row retrieval parameters. The vulnerability has been fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1. Users should upgrade to these versions or later. Temporary mitigations include restricting workflow editing permissions, disabling the SeaTable node, and avoiding unvalidated external input in affected parameters.
n8n versions prior to 1.123.32, between 2.0.0 and before 2.17.4, and between 2.18.0 and before 2.18.1 contain an open redirect vulnerability in the MCP OAuth consent flow. The /mcp-oauth/register endpoint allows unauthenticated registration of OAuth clients with arbitrary redirect_uri values. When a user denies consent, they are redirected to the registered redirect_uri without validation, enabling attackers to redirect users to malicious sites. This vulnerability has been fixed in versions 1.123.32, 2.17.4, and 2.18.1. Temporary mitigations include restricting network access and limiting user access to trusted users.
n8n's Oracle Database node contains an SQL injection vulnerability in the 'Limit' field when user-controlled input is passed via expressions without proper sanitization. This flaw allows attackers to inject arbitrary SQL commands, potentially leading to data exfiltration from the connected Oracle database. The vulnerability requires specific workflow configurations where external input reaches the 'Limit' field. It has been fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1. Temporary mitigations include restricting workflow editing permissions, disabling the Oracle Database node, and avoiding unvalidated input in the 'Limit' field.
n8n versions prior to 1.123.32, and certain 2.x versions before 2.17.4 and 2.18.1, contain SQL injection vulnerabilities in the Snowflake and legacy MySQL v1 nodes. These nodes improperly construct SQL queries by directly interpolating user-controlled identifiers without escaping, allowing attackers to execute arbitrary SQL commands if they can control workflow inputs. Exploitation requires specific workflow configurations with untrusted input passed into identifier fields. The vulnerability can lead to data exfiltration, modification, or deletion in the connected databases. Fixed versions are 1.123.32, 2.17.4, and 2.18.1. Temporary mitigations include restricting workflow editing, migrating to MySQL v2 node, disabling the Snowflake node, and avoiding unvalidated user input in affected fields.
n8n versions prior to 1.123.15 and versions from 2.0.0 up to but not including 2.5.0 contain a vulnerability in the GitHub Webhook Trigger node. This flaw allows an attacker who knows the webhook URL to send unsigned POST requests, triggering workflows with arbitrary data because the node lacks HMAC-SHA256 signature verification. The vulnerability has been fixed in versions 1.123.15 and 2.5.0 and later. Temporary mitigations include restricting workflow editing permissions and limiting network access to known GitHub IP ranges, but these do not fully eliminate the risk.
n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime.
An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations.
Using string formatting and exception handling, an attacker may bypass n8n's python-task-executor sandbox restrictions and run arbitrary unrestricted Python code in the underlying operating system.
The vulnerability can be exploited via the Code block by an authenticated user with basic permissions and can lead to a full n8n instance takeover on instances operating under "Internal" execution mode.
If the instance is operating under the "External" execution mode (ex.n8n's official Docker image) - arbitrary code execution occurs inside a Sidecar container and not the main node, which significantly reduces the vulnerability impact.
A remote code execution vulnerability (CVE-2025-62726) affects the Git Node component in both Cloud and Self-Hosted versions of n8n prior to version 1.113.0. The flaw allows execution of arbitrary code when a malicious repository containing a pre-commit hook is cloned and committed via the Git Node. This can compromise the n8n environment and connected workflows or credentials. The issue is fixed in n8n version 1.113.0, which introduces an environment variable to mitigate the risk. Users are advised to upgrade and avoid cloning untrusted repositories with the Git Node until patched.