Threats Tagged 'ghsa-2x35-3fw4-9jr4'
View all threats tagged with 'ghsa-2x35-3fw4-9jr4'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'ghsa-2x35-3fw4-9jr4'
Click on any threat for detailed analysis and mitigation recommendations
n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion 0 The n8n Send Email node had a vulnerability where it did not enforce that message fields were strings, allowing crafted non-string inputs to be interpreted as file paths or URLs by the underlying mail library. This could lead to arbitrary local file disclosure or SSRF on the n8n host. Exploitation requires an active workflow with an unauthenticated webhook, valid SMTP credentials, and untrusted input mapped directly into email body fields, which is not the default configuration. The issue is fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1. Temporary mitigations include auditing workflows, restricting webhook access, and limiting workflow editing permissions. Join the discussion | GCVE Database | 07/22/2026, 22:09:11 UTC Added: 07/22/2026, 23:22:52 UTC |
Showing 1 to 1 of 1 result