An authorization bypass vulnerability exists in n8n versions before 1.123.85, 2.43.5, and 2.44.1 within the Chat Hub component. This flaw allows users with the global:chatUser role, who normally have limited chat-only permissions, to register restricted tool types and execute sandboxed code, access permitted files, and utilize instance workflows, Data Tables, and agents. The vulnerability has a medium severity rating with a CVSS score of 5.4.
n8n versions prior to 1.123.85, 2.43.5, and 2.44.1 contain an authorization bypass vulnerability. This flaw allows member users to access credentials they should not have permission to use by omitting default node parameters in workflows. Exploitation enables attackers to save and execute workflows that bypass pre-execution credential checks, resulting in decrypted credential values being sent to destinations controlled by the attacker.
A filter injection vulnerability exists in the Quick Base node of n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1. This flaw allows attackers to supply untrusted input, such as webhook data, that is sent as raw query text to the Quick Base API. Exploitation can cause the 'Get Many' operation to return all records or the 'Delete' operation to remove all records accessible by the workflow credentials.
A regular expression denial of service (ReDoS) vulnerability exists in n8n versions before 1.123.85, 2.43.5, and 2.44.1. Authenticated users who can create and run workflows may exploit this by submitting specially crafted wildcard-heavy File(s) Selector patterns. This causes exponential backtracking in the regex engine, blocking the event loop and rendering the UI, API, webhooks, and health checks unresponsive until the service is restarted.
A vulnerability in n8n versions before 2.43.5 and 2.44.x before 2.44.1 allows authenticated members with workflow creation and execution permissions to exploit a client-supplied workflow ID. By using a crafted ID such as __proto__, the application improperly caches workflow owner projects, causing project checks to match all projects. This flaw enables unauthorized listing, reading, modification, and deletion of Data Table rows across all projects within the instance.
A credential guard bypass vulnerability exists in n8n versions before 1.123.85, 2.43.5, and 2.44.1. This flaw allows editors of shared workflows to exploit the Execute Sub-workflow node by loading sub-workflows from URLs or local files, thereby accessing restricted credentials and obtaining their decrypted values.
A vulnerability in chrome-devtools-mcp component of Google Chrome on Linux versions prior to 1.5.0 allows a local attacker to perform arbitrary read and write operations via a malicious file due to insufficient policy enforcement. The issue is rated with medium severity by Chromium security.
Seroval versions 1.6.0 through 1.6.10 contain a vulnerability where typed arrays that have an own constructor property set from untrusted data can lead to code injection during serialization. This occurs because the constructor name is read from a mutable property on the typed array rather than its internal type, allowing arbitrary code to be serialized. The issue is fixed in version 1.6.11. The vulnerability requires unusual conditions where properties from untrusted objects are copied onto typed arrays.
Seroval versions before 1.0.0 and from 1.5.5 up to but not including 1.6.10 improperly serialize RegExp sources containing the '<' character without escaping it. This can allow an attacker to inject script code if the RegExp is built from untrusted input and the serialized output is placed inside an HTML <script> element. The vulnerability is fixed in version 1.6.10 by changing the serialization method to use the RegExp constructor with an escaped string source.
The Seroval library versions prior to 1.6.8 contain a denial-of-service vulnerability in the fromJSON and fromCrossJSON deserialization functions. These functions trust node-supplied array lengths and sequence doneAt indices without validation, allowing crafted inputs to cause infinite loops or prolonged blocking of the event loop. This can be triggered by unauthenticated requests passing untrusted input, resulting in service unavailability. The issue is fixed in version 1.6.8 by enforcing strict validation of array elements and sequence indices, throwing errors on malformed input.
Seroval versions from 1.4.1 up to but not including 1.6.8 contain a denial of service vulnerability in the fromJSON and fromCrossJSON functions. These functions fail to validate that an array node's element list is actually an array, allowing crafted payloads to control memory allocation and processing loops. This can cause the service to become unavailable due to excessive memory use or prolonged thread blocking. The issue bypasses a previous fix and affects any framework using these functions to decode untrusted request bodies before validation. The vulnerability is fixed in version 1.6.8.
A vulnerability in mem0ai's session key construction allows cross-tenant data leakage and corruption. The function _build_session_scope() concatenates user_id, agent_id, and run_id with unescaped '&' and '=' delimiters, enabling an attacker controlling only run_id or agent_id to craft values that collide with another tenant's session key. This leads to unauthorized reading and overwriting of another tenant's conversation history. The flaw affects both Python and TypeScript SDKs and is fixed in versions 2.0.18 and 3.1.6.
A vulnerability in ONNX ConvTranspose shape inference causes an out-of-bounds read when the weight tensor has fewer than three dimensions and no kernel_shape attribute is provided. This leads to a process crash (denial of service) during shape inference on a crafted model. The issue affects ONNX versions 1.2.1 through 1.21.0 and is fixed in version 1.22.0. No confidentiality or integrity impact is reported.
ONNX versions prior to 1.22.0 contain a vulnerability in their Python tensor-materialization helpers where packed sub-byte tensors are expanded without verifying that the payload contains the declared number of elements. This can cause excessive memory allocation when processing maliciously crafted models, leading to denial of service via memory exhaustion. The issue affects specific tensor types stored in raw_data or packed int32_data. The vulnerability is fixed in ONNX 1.22.0 and later.
A vulnerability in ONNX shape inference (versions 1.4.0 through 1.21.0) allows denial of service via null pointer dereference or excessive allocation caused by improper validation of the required Scan attribute 'num_scan_inputs'. This can cause application termination or exceptions when processing malformed models. The issue is fixed in ONNX 1.22.0.
ONNX versions through 1.21.0 have a vulnerability in shape inference for RNN, GRU, and LSTM nodes from opsets 1–6 where an out-of-bounds read occurs if the first input's rank is not three. This can cause a process using onnx.shape_inference.infer_shapes() to crash, resulting in denial of service. The issue is fixed in ONNX 1.22.0 by validating the input rank before accessing dimensions.
vLLM deployments serving DeepSeek-OCR family models are vulnerable to a denial of service caused by a crafted PNG image. A legitimate half-black/half-white 1024×1024 image triggers a zero-sum pixel value condition that causes the model's input validation to return None. This leads to an assertion failure in the engine worker process, crashing the entire service and requiring manual restart. The issue affects versions from 0.11.1 up to but not including 0.32.0 and is fixed in version 0.32.0.
vLLM versions prior to 0.32.0 contain a vulnerability where an out-of-vocabulary token ID equal to the vocabulary size can bypass input validation and cause a CUDA device-side assert, crashing the engine. This affects models whose vocabulary size is an exact multiple of the embedding padding size (64), such as Llama-2-family models with a vocab size of 32000. The issue occurs specifically when using a single GPU (tensor parallel size 1) configuration. The flaw was fixed in vLLM version 0.32.0 by correcting the maximum accepted token ID validation.
A denial of service vulnerability exists in github.com/go-jose/go-jose/v4 where parsing deeply nested JSON structures can cause the Go runtime to hit its stack limit and crash the application. This affects versions prior to 4.1.5 and up to 3.0.5. The issue is fixed in version 4.1.5. Applications parsing untrusted JSON with affected versions are exposed to crashes.
A denial of service vulnerability exists in github.com/go-jose/go-jose/v4 when decrypting ciphertexts using the CBC-HMAC content encryption algorithms A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512. Insufficient validation of parameters can cause a panic due to indexing into an empty buffer on untrusted input. This affects versions prior to 4.1.5 and up to 3.0.5. A fix is available in version 4.1.5.