Skip to content

Commit f10eed9

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-364x-8g5j-x2pr GHSA-3c7f-5hgj-h279 GHSA-w673-8fjw-457c
1 parent a758143 commit f10eed9

3 files changed

Lines changed: 276 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-364x-8g5j-x2pr/GHSA-364x-8g5j-x2pr.json‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-364x-8g5j-x2pr",
4+
"modified": "2026-03-27T18:08:15Z",
5+
"published": "2026-03-27T18:08:15Z",
6+
"aliases": [],
7+
"summary": "n8n has XSS in its Credential Management Flow",
8+
"details": "## Impact\nAn authenticated user with permission to create and share credentials could craft a malicious OAuth2 credential containing a JavaScript URL in the Authorization URL field. If a victim opened the credential and interacted with the OAuth authorization button, the injected script would execute in their browser session.\n\n## Patches\nThe issue has been fixed in n8n versions 2.8.0 and 2.6.4. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Limit credential creation and sharing permissions to fully trusted users only.\n- Restrict access to the n8n instance to trusted users only.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
13+
},
14+
{
15+
"type": "CVSS_V4",
16+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"
17+
}
18+
],
19+
"affected": [
20+
{
21+
"package": {
22+
"ecosystem": "npm",
23+
"name": "n8n"
24+
},
25+
"ranges": [
26+
{
27+
"type": "ECOSYSTEM",
28+
"events": [
29+
{
30+
"introduced": "2.7.0"
31+
},
32+
{
33+
"fixed": "2.8.0"
34+
}
35+
]
36+
}
37+
]
38+
},
39+
{
40+
"package": {
41+
"ecosystem": "npm",
42+
"name": "n8n"
43+
},
44+
"ranges": [
45+
{
46+
"type": "ECOSYSTEM",
47+
"events": [
48+
{
49+
"introduced": "0"
50+
},
51+
{
52+
"fixed": "2.6.4"
53+
}
54+
]
55+
}
56+
]
57+
}
58+
],
59+
"references": [
60+
{
61+
"type": "WEB",
62+
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-364x-8g5j-x2pr"
63+
},
64+
{
65+
"type": "PACKAGE",
66+
"url": "https://github.com/n8n-io/n8n"
67+
}
68+
],
69+
"database_specific": {
70+
"cwe_ids": [
71+
"CWE-79"
72+
],
73+
"severity": "MODERATE",
74+
"github_reviewed": true,
75+
"github_reviewed_at": "2026-03-27T18:08:15Z",
76+
"nvd_published_at": null
77+
}
78+
}

‎advisories/github-reviewed/2026/03/GHSA-3c7f-5hgj-h279/GHSA-3c7f-5hgj-h279.json‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3c7f-5hgj-h279",
4+
"modified": "2026-03-27T18:06:49Z",
5+
"published": "2026-03-27T18:06:49Z",
6+
"aliases": [],
7+
"summary": "n8n has XSS in Chat Trigger Node through Custom CSS",
8+
"details": "## Impact\nAn authenticated user with permission to create or modify workflows could inject malicious JavaScript into the Custom CSS field of the Chat Trigger node. Due to a misconfiguration in the `sanitize-html` library, the sanitization could be bypassed, resulting in stored XSS on the public chat page. Any user visiting the chat URL would be affected.\n\n## Patches\nThe issue has been fixed in n8n versions 1.123.27, 2.13.3, and 2.14.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Limit workflow creation and editing permissions to fully trusted users only.\n- Disable the Chat Trigger node by adding `@n8n/n8n-nodes-langchain.chatTrigger` to the `NODES_EXCLUDE` environment variable.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
13+
},
14+
{
15+
"type": "CVSS_V4",
16+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"
17+
}
18+
],
19+
"affected": [
20+
{
21+
"package": {
22+
"ecosystem": "npm",
23+
"name": "n8n"
24+
},
25+
"ranges": [
26+
{
27+
"type": "ECOSYSTEM",
28+
"events": [
29+
{
30+
"introduced": "0"
31+
},
32+
{
33+
"fixed": "1.123.27"
34+
}
35+
]
36+
}
37+
]
38+
},
39+
{
40+
"package": {
41+
"ecosystem": "npm",
42+
"name": "n8n"
43+
},
44+
"ranges": [
45+
{
46+
"type": "ECOSYSTEM",
47+
"events": [
48+
{
49+
"introduced": "2.14.0"
50+
},
51+
{
52+
"fixed": "2..14.1"
53+
}
54+
]
55+
}
56+
],
57+
"versions": [
58+
"2.14.0"
59+
]
60+
},
61+
{
62+
"package": {
63+
"ecosystem": "npm",
64+
"name": "n8n"
65+
},
66+
"ranges": [
67+
{
68+
"type": "ECOSYSTEM",
69+
"events": [
70+
{
71+
"introduced": "2.0.0-rc.0"
72+
},
73+
{
74+
"fixed": "2.13.3"
75+
}
76+
]
77+
}
78+
]
79+
}
80+
],
81+
"references": [
82+
{
83+
"type": "WEB",
84+
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-3c7f-5hgj-h279"
85+
},
86+
{
87+
"type": "PACKAGE",
88+
"url": "https://github.com/n8n-io/n8n"
89+
}
90+
],
91+
"database_specific": {
92+
"cwe_ids": [
93+
"CWE-79"
94+
],
95+
"severity": "MODERATE",
96+
"github_reviewed": true,
97+
"github_reviewed_at": "2026-03-27T18:06:49Z",
98+
"nvd_published_at": null
99+
}
100+
}

‎advisories/github-reviewed/2026/03/GHSA-w673-8fjw-457c/GHSA-w673-8fjw-457c.json‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-w673-8fjw-457c",
4+
"modified": "2026-03-27T18:06:28Z",
5+
"published": "2026-03-27T18:06:28Z",
6+
"aliases": [],
7+
"summary": "n8n: Authenticated XSS and Open Redirect via Form Node",
8+
"details": "## Impact\nAn authenticated user with permission to create or modify workflows could configure a Form Node with an unsanitized HTML description field or exploit an overly permissive iframe sandbox policy to perform stored cross-site scripting or redirect end users visiting the form to an arbitrary external URL. The vulnerability could be used to facilitate phishing attacks.\n\n## Patches\nThe issue has been fixed in n8n versions 1.123.24, 2.10.4 and 2.12.0. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Limit workflow creation and editing permissions to fully trusted users only.\n- Disable the Form node by adding `n8n-nodes-base.form` to the `NODES_EXCLUDE` environment variable.\n- Disable the Form Trigger node by adding `n8n-nodes-base.formTrigger` to the `NODES_EXCLUDE` environment variable.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N"
13+
},
14+
{
15+
"type": "CVSS_V4",
16+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
17+
}
18+
],
19+
"affected": [
20+
{
21+
"package": {
22+
"ecosystem": "npm",
23+
"name": "n8n"
24+
},
25+
"ranges": [
26+
{
27+
"type": "ECOSYSTEM",
28+
"events": [
29+
{
30+
"introduced": "2.11.0"
31+
},
32+
{
33+
"fixed": "2.12.0"
34+
}
35+
]
36+
}
37+
]
38+
},
39+
{
40+
"package": {
41+
"ecosystem": "npm",
42+
"name": "n8n"
43+
},
44+
"ranges": [
45+
{
46+
"type": "ECOSYSTEM",
47+
"events": [
48+
{
49+
"introduced": "2.0.0-rc.0"
50+
},
51+
{
52+
"fixed": "2.10.4"
53+
}
54+
]
55+
}
56+
]
57+
},
58+
{
59+
"package": {
60+
"ecosystem": "npm",
61+
"name": "n8n"
62+
},
63+
"ranges": [
64+
{
65+
"type": "ECOSYSTEM",
66+
"events": [
67+
{
68+
"introduced": "0"
69+
},
70+
{
71+
"fixed": "1.123.24"
72+
}
73+
]
74+
}
75+
]
76+
}
77+
],
78+
"references": [
79+
{
80+
"type": "WEB",
81+
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-w673-8fjw-457c"
82+
},
83+
{
84+
"type": "PACKAGE",
85+
"url": "https://github.com/n8n-io/n8n"
86+
}
87+
],
88+
"database_specific": {
89+
"cwe_ids": [
90+
"CWE-601",
91+
"CWE-79"
92+
],
93+
"severity": "MODERATE",
94+
"github_reviewed": true,
95+
"github_reviewed_at": "2026-03-27T18:06:28Z",
96+
"nvd_published_at": null
97+
}
98+
}

0 commit comments

Comments
 (0)