{"data":{"id":"9aeac69d-e085-43c2-992e-275590be6832","title":"GHSA-xmc9-4f2h-jf9c: n8n: Edit Image Node Format Injection Allows Arbitrary File Write","summary":"The n8n Edit Image node failed to validate its output format parameter before passing it to an image library, allowing an authenticated user to write arbitrary files anywhere on the n8n instance (a vulnerability called format injection, where unvalidated input to a file operation bypasses normal restrictions). This could let someone with workflow access overwrite or create files they shouldn't be able to touch.","solution":"The issue has been fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should restrict n8n instance access to fully trusted users only, or disable the Edit Image node by adding `n8n-nodes-base.editImage` to the `NODES_EXCLUDE` environment variable. The source notes these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-xmc9-4f2h-jf9c","publishedAt":"2026-07-22T22:11:49.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":[],"issueType":"vulnerability","affectedPackages":["n8n@>= 2.0.0-rc.0, < 2.31.5 (fixed: 2.31.5)","n8n@>= 2.32.0, < 2.32.1 (fixed: 2.32.1)","n8n@< 1.123.67 (fixed: 1.123.67)"],"affectedVendors":[],"affectedVendorsRaw":["n8n"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":true,"disclosureDate":"2026-07-22T22:11:49.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}