GHSA-xmc9-4f2h-jf9c: n8n: Edit Image Node Format Injection Allows Arbitrary File Write
- Identifier
- GHSA-xmc9-4f2h-jf9c
- Published
- Record updated
- Affected
- n8n >= 2.0.0-rc.0, < 2.31.5, fixed in 2.31.5, released July 22, 2026, on the day of disclosure
- n8n >= 2.32.0, < 2.32.1, fixed in 2.32.1, released July 22, 2026, on the day of disclosure
- n8n < 1.123.67, fixed in 1.123.67, released July 22, 2026, on the day of disclosure
Summary
GHSA-xmc9-4f2h-jf9c affects the Edit Image node in n8n. The node passed its output format to the underlying image library without validation, so a crafted value could write bytes outside the node's working directory. An authenticated user able to run workflows could write arbitrary files on the n8n instance.
Mitigation
Fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1; upgrade to one of these or later. If upgrading is not immediately possible, restrict instance access to fully trusted users only and disable the Edit Image node by adding `n8n-nodes-base.editImage` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and are short-term measures only.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- n8nnpmLLM dependency since 2026-02-10
Related items
- MediumCVE-2026-127202: MLflow path traversal through model_id in the log outputs APISimilar attack · NVD/CVE Database
- LowAI chatbots are recommending fake retail websites, study findsSimilar attack · The Verge (AI)
- MediumPalo Alto tracks a massive Chinese AI attack that sadly lives up to industry fearsSimilar attack · CSO Online
- MediumAttackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society SectorsSimilar attack · Palo Alto Unit 42
- MediumCVE-2026-126994: braindecode model config deserialization flaw via activation argumentSimilar attack · NVD/CVE Database