Dyingman1

An unsafe deserialization issue exists when the database opens a file and triggers an automatic migration path for legacy v1-format stores. The process uses the `MVStoreUtils.openOrCreate()` function, which calls `NitriteDataType.deserialize(byte[])`. This function passes raw bytes to `java.io.ObjectInputStream.readObject()` via a custom `NitriteObjectInputStream` subclass that lacks a class allowlist, blocklist, or `ObjectInputFilter`. Consequently, any `Serializable` class on the application's classpath can be instantiated, potentially allowing an unauthenticated remote attacker to achieve remote code execution if a suitable gadget class is present.

An integer wraparound exists in the `Handle 0x38 RequestFileTransfer()` function. This allows unauthenticated attackers to bypass the file path length check by sending a short RequestFileTransfer (SID 0x38) request with the `filePathAndNameLength` variable set between 0xFFFC and 0xFFFF. This can lead to callbacks reading past the receive buffer, resulting in target crashes or memory disclosure.

An issue exists in the Server-Side Request Forgery (SSRF) protection within the `AddressPredicate.java` file. While the system blocks the RFC 6052 64:ff9b::/96 NAT64 prefix, it fails to block the RFC 8215 64:ff9b:1::/48 local-use prefix. On dual-stack servers utilizing RFC 8215 NAT64, an unauthenticated user capable of executing Lua code can utilize the `http.request` or `http.websocket` functions with an address under 64:ff9b:1::/48 to access loopback, RFC 1918, cloud metadata, or internal API endpoints. This occurs because the `PrivatePattern.matches()` function does not correctly classify the mapped IPv6 address as private.

The `nodes/SqliteNode/v1/SqliteV1.node.ts` file exposes the `db path` parameter, which allows data expressions from upstream workflow input. If a workflow author maps untrusted input to this parameter, a remote attacker can control which SQLite file the process opens. This enables path traversal, allowing the attacker to read, create, or overwrite files accessible to the n8n process. This issue is particularly risky in multi-tenant or user-facing deployments where untrusted users can influence workflow configuration.

A relative path traversal issue allows for arbitrary file read operations from the Agent host filesystem. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the web root folder by manipulating variables such as file paths.

An information disclosure issue exists where the `edit` context on a REST endpoint is not properly restricted by the `edit users` capability. This allows unauthenticated visitors to retrieve sensitive user data, including roles, full capabilities map, extra capabilities, locale, and registration date, by sending a crafted request.

Applications that pass user-controlled input to the `Handlebars.compile()` function using a FileTemplateLoader or ClassPathTemplateLoader are susceptible to arbitrary file read. This occurs when web applications utilize template names sourced from URL path parameters, request parameters, or other user-controlled inputs, allowing for path traversal.

A cross-site request forgery (CSRF) flaw allows attackers to resume failed Multijob builds. CSRF is a type of attack that tricks a victim into submitting a malicious request to a web application where they are currently authenticated.

The plugin fails to restrict the redirect URL after the login process, which enables attackers to conduct phishing attacks via open redirection.

A missing permission check in an HTTP endpoint allows users with Overall/Read permissions to enumerate the IDs of credentials stored within Jenkins.

The buildgraph-view Plugin fails to escape the build URL, leading to a stored cross-site scripting (XSS) issue. This can be exploited by attackers who have permissions to configure jobs or views. Cross-site scripting is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users.

A cross-site request forgery (CSRF) flaw allows attackers to trigger a build for a pull request. CSRF is a type of attack that tricks a victim into submitting a malicious request to a web application where they are currently authenticated.

The plugin does not restrict the redirect URL after login, which allows attackers to perform phishing attacks.