Threats affecting pkg:npm/n8n

n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary Databricks API endpoints by injecting unencoded resource identifiers. Attackers can supply ../ sequences and query strings via webhook, chat, or form inputs mapped to spaceId, indexName, or filePath to read secrets using the stored credential.

n8n versions prior to 2.42.6, 2.43.3, and 3.0.1 contain a remote code execution vulnerability due to improper isolation of certain deprecated nodes. Authenticated users able to create or modify workflows with these nodes can execute JavaScript in the main n8n process, leading to high-severity impact.

n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 improperly store credential secrets in execution error data for certain nodes. This exposure occurs when operations fail in the Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes. Users with permission to view workflow executions but without credential read access can extract sensitive secrets such as Git passwords or tokens, MongoDB passwords, and Google access tokens from the error data.

An authorization bypass vulnerability exists in n8n versions before 1.123.85, 2.43.5, and 2.44.1 within the Chat Hub component. This flaw allows users with the global:chatUser role, who normally have limited chat-only permissions, to register restricted tool types and execute sandboxed code, access permitted files, and utilize instance workflows, Data Tables, and agents. The vulnerability has a medium severity rating with a CVSS score of 5.4.

CVE-2026-118679 is a server-side request forgery (SSRF) vulnerability in the Slack Trigger webhook of n8n versions before 1.123.83, 2.41.4, and 2.42.1. This flaw allows unauthenticated attackers to bypass signature verification when no signing secret is set, enabling them to exfiltrate Slack workspace access tokens by triggering the webhook with a specially crafted request. The vulnerability is fixed in versions 1.123.83, 2.41.4, and 2.42.1.

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users to alter built-in object behaviour by saving workflows with specially named connection keys. Attackers can add keys such as __proto__ to workflow connections, which the periodic history compaction task processes, causing logins and writes to fail with server errors.

CVE-2026-118677 is a vulnerability in n8n's Local Gateway desktop app before versions 2.41.4 and 2.42.1. It involves improper authorization in the deep-link connect handler for the custom URL scheme n8n-computer-use://. This flaw allows an attacker to silently re-pair the app with a malicious n8n instance by tricking a user into opening a crafted link, inheriting previously granted permissions and potentially acting on the user's computer through the gateway.

n8n versions before 1.123.85, 2.43.5, and 2.44.1 contain an authorization bypass vulnerability. This flaw allows member users to access credentials they should not have permission to use by omitting default node parameters in workflows. Exploiting this, attackers can save and execute workflows that skip pre-execution credential checks, causing decrypted credential values to be sent to destinations controlled by the attacker.

CVE-2026-118675 is a credential guard bypass vulnerability in n8n versions before 1.123.85, 2.43.5, and 2.44.1. It allows editors of shared workflows to access restricted credentials by exploiting the Execute Sub-workflow node with maliciously crafted source URLs or local files. This vulnerability enables attackers to retrieve decrypted credential values improperly.

n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as __proto__ makes the Data Table project check match every project. An authenticated member who can create and run workflows can list, read, modify, and delete Data Table rows in all projects of the instance.

n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contain a stored cross-site scripting (XSS) vulnerability. This occurs because certain webhook response paths omit the sandbox Content-Security-Policy header, allowing authenticated users who can create and activate workflows to serve malicious HTML. This HTML executes scripts in the context of the n8n origin, potentially hijacking sessions of users who open the webhook URL.

A vulnerability in n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 causes the SeaTable Trigger node's API token to be saved in error execution data. This occurs because failed poll requests store raw request headers, exposing sensitive API tokens to users who can view workflow executions but do not have credential read access.

n8n versions prior to 1.123.85, 2.43.5, and 2.44.1 contain a regular expression denial of service (ReDoS) vulnerability. Authenticated users who can create and run workflows may exploit this by submitting crafted glob patterns with excessive wildcards, causing exponential backtracking. This results in blocking the event loop and making the UI, API, webhooks, and health checks unresponsive until the system is restarted.

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick Base node, which sends the Where filter to the Quick Base API as raw query text. Attackers supplying untrusted input such as webhook data used to build the filter can make Get Many return every record or Delete remove every record with the workflow credential's privileges.