GHSA-xmc9-4f2h-jf9c: n8n: Edit Image Node Format Injection Allows Arbitrary File Write
Summary
The n8n Edit Image node failed to validate its output format parameter before passing it to an image library, allowing an authenticated user to write arbitrary files anywhere on the n8n instance (a vulnerability called format injection, where unvalidated input to a file operation bypasses normal restrictions). This could let someone with workflow access overwrite or create files they shouldn't be able to touch.
Solution / Mitigation
The issue has been fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should restrict n8n instance access to fully trusted users only, or disable the Edit Image node by adding `n8n-nodes-base.editImage` to the `NODES_EXCLUDE` environment variable. The source notes these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Classification
Affected Vendors
Affected Packages
Original source: https://github.com/advisories/GHSA-xmc9-4f2h-jf9c
First tracked: July 22, 2026 at 08:01 PM
Classified by LLM (prompt v3) · confidence: 85%