Security: n8n-io/n8n
Security Advisories
View information about security vulnerabilities from this repository's maintainers.
-
Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource SubstitutionGHSA-cw9w-vv67-hf73 published
Sep 3, 2026 by MatsuuuModerate -
Git Node File Sandbox Escape via Relative Remote URL Base-Directory MismatchGHSA-fm93-2x43-6676 published
Sep 2, 2026 by csuermannModerate -
Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code ExecutionGHSA-6xcw-7xm6-48c6 published
Sep 2, 2026 by csuermannHigh -
Improper Authorization in Source Control Push Allows Cross-Project Workflow and Credential DeletionGHSA-hvrx-jc5j-pg3w published
Sep 2, 2026 by csuermannModerate -
Disabled OIDC SSO Endpoints Remain Active and Issue Valid SessionsGHSA-pf83-w3f9-8m37 published
Sep 2, 2026 by MatsuuuModerate -
Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model NodeGHSA-34ff-336r-5q23 published
Sep 2, 2026 by csuermannHigh -
Agent Workflow Tool Bypasses Sub-Workflow Caller PolicyGHSA-7hgx-277f-7vmg published
Sep 2, 2026 by csuermannModerate -
Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone PathGHSA-j535-v25q-vx3q published
Sep 2, 2026 by csuermannHigh -
GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-OpenGHSA-5m98-cgcr-xx3q published
Sep 2, 2026 by csuermannModerate -
Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded IdentifiersGHSA-f2cp-m7mv-8jpv published
Sep 2, 2026 by csuermannModerate