AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

n8n

n8n Workflow Automation Tool

Declares an LLM dependency since 2026-04-29 (version 2.19.1).

npmLatest 2.42.6First release 2019-04-24Registry page RepositoryChecked 2026-10-09

Advisories

Advisories that name n8n as affected. Advisory records do not state an ecosystem, so packages with the same name in other ecosystems also match. For a version-exact check of your own dependencies, use Stack Check.

Advisory	Severity	Affected	Fixed in	Published
CVE-2026-86074GHSA-q5wm-mgqx-fv2f: n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content	Medium	< 2.37.7	2.37.7	2026-09-10
CVE-2026-86084GHSA-pf83-w3f9-8m37: n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions	Medium	>= 2.0.0, < 2.37.7	2.37.7	2026-09-10
CVE-2026-86080GHSA-5m98-cgcr-xx3q: n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open	Medium	>= 2.0.0, < 2.37.7	2.37.7	2026-09-10
CVE-2026-86078GHSA-679f-58pq-4v2c: n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service	Medium	< 2.37.7	2.37.7	2026-09-10
CVE-2026-86994GHSA-65xw-2v52-jhxc: n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter	Medium	>= 2.0.0, < 2.37.7	2.37.7	2026-09-10
CVE-2026-86083GHSA-6xcw-7xm6-48c6: n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution	High	>= 2.0.0, < 2.37.7	2.37.7	2026-09-10
CVE-2026-86077GHSA-35jj-42hp-8gmq: n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket	Medium	< 2.37.7	2.37.7	2026-09-10
CVE-2026-86075GHSA-hh89-3r9w-qj3j: n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint	High	< 2.37.7	2.37.7	2026-09-10
CVE-2026-86996GHSA-7hgx-277f-7vmg: n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy	Medium	< 2.37.7	2.37.7	2026-09-08
CVE-2026-65589GHSA-89gh-3pgc-v5h2: n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data	Medium	>= 2.0.0-rc.0, < 2.29.8	2.29.8	2026-07-22
CVE-2026-65014GHSA-33q9-f52j-gc75: n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook	Medium	< 2.27.4	2.27.4	2026-07-22
CVE-2026-65596GHSA-gq66-9cw5-j5jm: n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction	Medium	>= 2.0.0, < 2.29.8	2.29.8	2026-07-22
CVE-2026-65594GHSA-q5xf-xhwf-cwqf: n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check	Medium	< 2.29.8	2.29.8	2026-07-22
CVE-2026-65590GHSA-fpg6-x68q-5793: n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows	Medium	< 2.29.8	2.29.8	2026-07-22
CVE-2026-59253GHSA-2xgm-wc4g-5jvg: n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects	Medium	< 2.28.0	2.28.0	2026-07-22
CVE-2026-59254GHSA-2434-3x6q-8r99: n8n: External Secrets Accessible via Workflow Expressions Outside Credentials	Medium	< 2.27.4	2.27.4	2026-07-22
GHSA-pf2q-pxhf-hgmw: n8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base Directory	Medium	< 2.31.5	2.31.5	2026-07-22
GHSA-hx4h-vr3m-45vh: n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service	Medium	>= 2.0.0-rc.0, < 2.31.5	2.31.5	2026-07-22
GHSA-xwx6-jjhv-84p8: n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service	High	>= 2.0.0-rc.0, < 2.31.5	2.31.5	2026-07-22
GHSA-xmc9-4f2h-jf9c: n8n: Edit Image Node Format Injection Allows Arbitrary File Write	High	>= 2.0.0-rc.0, < 2.31.5	2.31.5	2026-07-22
GHSA-cj9h-qx8g-pq2g: n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON	High	>= 2.0.0-rc.0, < 2.31.5	2.31.5	2026-07-22
GHSA-gv7g-jm28-cr3m: n8n: Expression sandbox escape via arrow-function bodies enabling command execution	High	< 2.31.5	2.31.5	2026-07-22
GHSA-vhf8-cg2h-cg3p: n8n: SSRF Protection Bypass via MCP Client Node	Medium	< 2.31.5	2.31.5	2026-07-22
CVE-2026-65592GHSA-9wcp-9r3j-383q: n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`	High	>= 2.0.0-rc.0, < 2.29.8	2.29.8	2026-07-22
CVE-2026-65015GHSA-x5vx-c2c8-m3w9: n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool	High	< 2.29.8	2.29.8	2026-07-22
GHSA-h5xr-fqvj-253p: Duplicate Advisory: Stored DOM XSS via Resource Locator `cachedResultUrl`	High	< 1.123.64		2026-07-22
GHSA-w46p-w7w2-fr9g: Duplicate Advisory: AI Agents Project Viewer Privilege Escalation via run_node_tool	High	< 2.29.8		2026-07-22
GHSA-664h-gpgq-h6xx: n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints	Medium	>= 2.0.0-rc.0, < 2.25.7	2.25.7	2026-06-17
CVE-2026-54309GHSA-qrx8-25qr-5r7v: n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions	High	< 2.25.7	2.25.7	2026-06-16
GHSA-h3jj-5f3v-3685: n8n: Public API Execution Retry Authorization Bypass	Medium	< 2.25.7	2.25.7	2026-06-16
GHSA-jwm3-qcfw-c5pp: n8n: Python Code Node AST Validator Bypass	Medium	< 2.25.7	2.25.7	2026-06-16
CVE-2026-54302GHSA-42h7-m79w-wvg5: n8n: Stored XSS in Chat Trigger Node	High	>= 2.0.0-rc.0, < 2.25.7	2.25.7	2026-06-16
CVE-2026-49444GHSA-9pq8-m8gp-4p53: n8n: Python sandbox escape	High	>= 2.0.0-rc.0, < 2.21.8	2.21.8	2026-06-16
GHSA-3875-8gcx-7v46: n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass	Medium	< 2.20.0	2.20.0	2026-05-19
GHSA-2vx9-7wpg-88jq: n8n: Legacy ExecuteWorkflow Node Bypassed File Path Restrictions	Medium	< 2.19.3	2.19.3	2026-05-19
CVE-2026-45732GHSA-6h4j-wcr9-2vg7: n8n Has a Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints	High	>= 2.0.0-rc.0, < 2.20.7	2.20.7	2026-05-14
CVE-2026-44789GHSA-c8xv-5998-g76h: n8n: HTTP Request Node Pagination Prototype Pollution to RCE	Critical	>= 2.0.0-rc.0, < 2.20.7	2.20.7	2026-05-14
CVE-2026-42232GHSA-hqr4-h3xv-9m3r: n8n has XML Node Prototype Pollution that to RCE	Critical	< 1.123.32	1.123.32	2026-04-29
CVE-2026-42231GHSA-q5f4-99jv-pgg5: n8n has Prototype Pollution in XML Webhook Body Parser that Leads to RCE	Critical	>= 2.17.0, < 2.17.4	2.17.4	2026-04-29
CVE-2026-42235GHSA-537j-gqpc-p7fq: n8n Vulnerable to XSS via MCP OAuth client	High	>= 2.17.0, < 2.17.4	2.17.4	2026-04-29
CVE-2026-42226GHSA-r4v6-9fqc-w5jr: n8n's Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay	High	< 1.123.33	1.123.33	2026-04-29
CVE-2026-42234GHSA-44v6-jhgm-p3m4: n8n has a Python Task Runner Sandbox Escape Vulnerability	High	>= 2.17.0, < 2.17.4	2.17.4	2026-04-29
CVE-2026-42227GHSA-756q-gq9h-fp22: n8n has Public API Variables IDOR that Allows Cross-Project Secret Disclosure	Medium	>= 2.0.0, < 2.17.4	2.17.4	2026-04-29
CVE-2026-42236GHSA-49m9-pgww-9vq6: n8n Vulnerable to Unauthenticated Denial of Service via MCP Client Registration	High	>= 2.0.0, < 2.17.4	2.17.4	2026-04-29
CVE-2026-42228GHSA-f77h-j2v7-g6mw: n8n Vulnerable to Hijacking of Unauthenticated Chat Execution	Medium	>= 2.0.0, < 2.17.4	2.17.4	2026-04-29
CVE-2026-42229GHSA-mp4j-h6gh-f6mp: n8n has SQL Injection in SeaTable Node	Medium	>= 2.0.0, < 2.17.4	2.17.4	2026-04-29
CVE-2026-42230GHSA-f6x8-65q6-j9m9: n8n has Open Redirect in MCP OAuth Consent Flow	Medium	>= 2.0.0, < 2.17.4	2.17.4	2026-04-29
CVE-2026-42233GHSA-r6jc-mpqw-m755: n8n has SQL Injection in Oracle Database Node via Limit Field	Medium	>= 2.0.0, < 2.17.4	2.17.4	2026-04-29
GHSA-364x-8g5j-x2pr: n8n has XSS in its Credential Management Flow	Medium	< 2.6.4	2.6.4	2026-03-27
GHSA-3c7f-5hgj-h279: n8n has XSS in Chat Trigger Node through Custom CSS	Medium	>= 2.0.0-rc.0, < 2.13.3	2.13.3	2026-03-27

Dependencies of the latest release

As declared in npm metadata for version 2.42.6. Optional extras are listed with their extra name.

aiVercel AI SDK
@ai-sdk/anthropicVercel AI SDK
@ai-sdk/openai-compatibleVercel AI SDK
@langchain/coreLangChain
@modelcontextprotocol/sdkModel Context Protocol SDK
@n8n/agentsModel Context Protocol SDK, Vercel AI SDK
@n8n/ai-utilitiesLangChain
@n8n/ai-workflow-builderLangChain, LangGraph
n8n-coreLangChain
@n8n/instance-aiVercel AI SDK
@n8n/mcp-browserModel Context Protocol SDK
@n8n/n8n-nodes-langchainAWS Bedrock Runtime client, Chroma +12
n8n-nodes-baseLLM
@pinecone-database/pineconePinecone
@qdrant/js-client-restQdrant
@n8n/ai-node-sdkreaches LLM
@n8n/dbreaches LLM
@n8n/node-engine-compatibilityreaches LLM
@n8n/task-runnerreaches LLM
@1password/connect
@apidevtools/json-schema-ref-parser
@asteasolutions/zod-to-openapi
@aws-sdk/client-secrets-manager
@azure/identity
@azure/keyvault-secrets
bcryptjs
bull
cache-manager
change-case
chat
@chat-adapter/discord
@chat-adapter/linear
@chat-adapter/slack
@chat-adapter/state-memory
@chat-adapter/teams
@chat-adapter/telegram
class-transformer
class-validator
compression
convict
cookie-parser
cron
csrf
csv-parse
dotenv
express
express-handlebars
express-openapi-validator
express-prom-bundle
express-rate-limit
fast-glob
fast-json-patch
fflate
file-type
flatted
formidable
@google-cloud/secret-manager
@grpc/grpc-js
handlebars
helmet
http-proxy-middleware
ioredis
isbot
isolated-vm
@joplin/turndown-plugin-gfm
jose
json-diff
json-schema
jsonschema
jsonwebtoken
langsmith
ldapts
linkedom
lodash
lru-cache
luxon
@modelcontextprotocol/node
@modelcontextprotocol/server
moment-timezone
@mozilla/readability
ms
multer
@n8n/api-types
@n8n/backend-common
@n8n/backend-network
@n8n/backend-services
@n8n/blob-storage
@n8n/chat-hub
@n8n/client-oauth2
@n8n/config
@n8n/constants
@n8n/decorators
@n8n/di
n8n-editor-ui
@n8n/engine
@n8n/errors
@n8n/expression-runtime
@n8n_io/ai-assistant-sdk
@n8n_io/license-sdk
@n8n/mcp-apps
@n8n/permissions
@n8n/scheduler
@n8n/syslog-client
@n8n/telemetry
@n8n/typeorm
@n8n/utils
n8n-workflow
@n8n/workflow-sdk
nanoid
nodemailer
oauth-1.0a
open
openid-client
@opentelemetry/api
@opentelemetry/core
@opentelemetry/exporter-trace-otlp-grpc
@opentelemetry/exporter-trace-otlp-proto
@opentelemetry/resources
@opentelemetry/sdk-trace-base
@opentelemetry/sdk-trace-node
@opentelemetry/semantic-conventions
otpauth
@parcel/watcher
p-cancelable
pdf-parse
pg
picocolors
pkce-challenge
p-limit
posthog-node
prom-client
psl
raw-body
reflect-metadata
replacestream
@rudderstack/rudder-sdk-node
samlify
semver
@sentry/node
shelljs
simple-git
source-map-support
sqlite3
sshpk
sucrase
@supabase/supabase-js
swagger-ui-express
tar
turndown
uuid
validator
ws
xml2js
xmllint-wasm
yaml
yargs-parser
zod
zod-to-json-schema