Assaf-Levkovich-Jf

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.113.0 **Description** n8n is a workflow automation platform with a remote code execution issue in the Git Node component, affecting both Cloud and Self-Hosted versions. A malicious actor can exploit this by cloning a repository containing a pre-commit hook. Utilizing the Commit operation within the Git Node inadvertently triggers the hook, allowing the attacker to execute arbitrary code within the n8n environment. This could compromise the system and any associated credentials or workflows. The vulnerability impacts users with workflows that utilize the Git Node to clone untrusted repositories. **Recommendations** Update to version 1.113.0 or later to resolve this issue. For self-hosted deployments, set the environment variable `N8N GIT NODE DISABLE BARE REPOS` to `true`. Avoid cloning or interacting with untrusted repositories using the Git Node. Disable or restrict the use of the Git Node in workflows where repository content cannot be fully trusted.

**Name of the Vulnerable Software and Affected Versions** Cursor versions 1.7 and below **Description** Cursor, a code editor for programming with AI, has an issue where automatic loading of project-specific CLI configuration from the current working directory (`<project>/.cursor/cli.json`) could override global configurations. This allowed users running the CLI inside a malicious repository to be vulnerable to Remote Code Execution through a combination of permissive configuration and prompt injection delivered via project-specific Rules (`<project>/.cursor/rules/rule.mdc`) or other mechanisms. The vulnerable configuration allows shell commands to be executed. **Recommendations** Update to patch 2025.09.17-25b418f.

**Name of the Vulnerable Software and Affected Versions** Flowise versions prior to 3.0.6 **Description** The Custom MCP feature, used for executing OS commands like launching local MCP servers, is unsandboxed. Due to a minimal authentication and authorization model lacking role-based access control, and the fact that default installations may run without authentication if `FLOWISE USERNAME` and `FLOWISE PASSWORD` are not configured, an attacker can execute arbitrary OS commands. This is achieved by sending a crafted JSON payload with the header `x-request-from: internal` to the '/api/v1/node-load-method/customMCP' endpoint, potentially leading to a complete compromise of the platform container or server. **Recommendations** Update to version 3.0.6 or later. Set the `FLOWISE USERNAME` and `FLOWISE PASSWORD` variables to enable authentication. Restrict access to the '/api/v1/node-load-method/customMCP' endpoint.