{"data":{"id":"ef69cdfd-662a-4deb-853d-22f331359a1b","title":"GHSA-xvh5-5qg4-x9qp: n8n has In-Process Memory Disclosure in its Task Runner","summary":"An authenticated user with permission to create or modify workflows can use the JavaScript Task Runner in n8n to allocate uninitialized memory buffers. Those buffers may contain residual data from the same Node.js process, including prior requests, tasks, secrets, or tokens, when Task Runners are enabled with N8N_RUNNERS_ENABLED=true. In external runner mode, exposure is limited to the external runner process.","solution":"The issue is fixed in n8n versions >= 1.123.22, >= 2.10.1, and >= 2.9.3; users should upgrade to these or later. If upgrading is not immediately possible, limit workflow creation and editing permissions to fully trusted users only, or use external runner mode (N8N_RUNNERS_MODE=external) to isolate the runner process. These workarounds do not fully remediate the risk and are short-term measures only.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-xvh5-5qg4-x9qp","publishedAt":"2026-03-25T17:00:25.000Z","cveId":"CVE-2026-27496","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["n8n@>= 2.0.0-rc.0, < 2.9.3 (fixed: 2.9.3)","n8n@>= 2.10.0, < 2.10.1 (fixed: 2.10.1)","n8n@< 1.123.22 (fixed: 1.123.22)"],"affectedPackageNames":["n8n"],"affectedPackageRefs":["npm:n8n"],"affectedVendors":[],"affectedVendorsRaw":["n8n"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00272,"epssCheckedAt":"2026-11-09T12:10:44.315Z","kevDateAdded":null,"advisoryAliases":["GHSA-xvh5-5qg4-x9qp"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-03-25T17:00:25.000Z","fixReleasedAt":"2026-02-25T08:17:05.836Z","daysToFix":-28,"fixCheckedAt":"2026-10-29T21:39:41.348Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.7,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"n8n","fixedVersion":"1.123.22","matchedVersion":"1.123.22","fixReleasedAt":"2026-02-25T11:24:04.313Z","daysToFix":-28,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:39:41.201Z"},{"ecosystem":"npm","name":"n8n","fixedVersion":"2.9.3","matchedVersion":"2.9.3","fixReleasedAt":"2026-02-25T10:27:21.887Z","daysToFix":-28,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:39:41.201Z"},{"ecosystem":"npm","name":"n8n","fixedVersion":"2.10.1","matchedVersion":"2.10.1","fixReleasedAt":"2026-02-25T08:17:05.836Z","daysToFix":-28,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:39:41.201Z"}]}}