Masofgon

An authentication bypass exists in the Chat Trigger when used in embedded chat mode. Unauthenticated attackers can bypass n8n User Auth by sending GET requests to the setup webhook route. This allows the attacker to read named session conversation history or trigger workflows using attacker-supplied input.

Insufficient validation of the update key value taken from incoming items in the MongoDB node allows for NoSQL injection. This occurs during Update and Find And Replace operations. Attackers providing untrusted input, such as a webhook body, to a workflow using these operations can cause the node to match and overwrite unintended documents or insert new documents into the MongoDB database.

The Quick Base node contains a filter injection flaw where the `Where` filter is transmitted to the Quick Base API as raw query text. An attacker providing untrusted input, such as data from a webhook used to construct the filter, can manipulate the request. This allows the attacker to force the Get Many operation to return all records or the Delete operation to remove all records, operating with the privileges of the workflow credentials.

Authenticated members can cause a regular expression denial of service by submitting crafted glob patterns within the File(s) Selector. This occurs when wildcard-heavy patterns trigger exponential backtracking, which blocks the event loop. Consequently, the UI, API, webhooks, and health checks become unresponsive, requiring a system restart to restore functionality.

A stored cross-site scripting issue exists because certain webhook response paths, including error responses and responses lacking headers, do not implement the sandbox Content-Security-Policy (a security layer that helps detect and mitigate certain types of attacks, including XSS). Authenticated members with permissions to create and activate workflows can deliver HTML that executes on the n8n origin, allowing scripts to operate using the session of any user who accesses the webhook URL.

An authorization bypass allows member users to utilize credentials they are not permitted to access by omitting default node parameters. This occurs because pre-execution checks skip credential slots when workflows are saved and executed, resulting in decrypted credential values being transmitted to destinations selected by the attacker.

Low-privileged users can alter built-in object behavior by saving workflows with specially named connection keys. By adding keys such as ` proto ` to workflow connections, the periodic history compaction task processes these keys, leading to server errors that cause logins and writes to fail. This is a prototype pollution issue, where an attacker manipulates the prototype of a base object to change the behavior of all objects inheriting from it.

An authorization bypass allows authenticated members to utilize credentials they are not permitted to access. This occurs through inline sub-workflow nodes when non-boolean values are used in the `disabled` parameter. An attacker with knowledge of a credential ID can use Execute Workflow nodes in inline JSON mode to bypass permission checks and transmit decrypted credentials to external servers under their control.

An uncontrolled resource consumption issue exists in the unauthenticated OAuth authorize endpoint. The system resolves clients by URL path but stores the raw identifier of the caller as the record key. Unauthenticated attackers can submit identifiers that differ only in their query string to create an unlimited number of first-party client records. This process bypasses the registration cap and can lead to database growth that eventually fills the disk.

An authenticated user can bypass file-access checks in the Git node by nesting a repository one level below the configured `repositoryPath`. The system validates a relative remote URL against the `repositoryPath` but invokes git using that path as the working directory, allowing git to resolve the URL outside the sandbox. This enables a user to perform a fetch or pull operation to read a git repository located outside `N8N RESTRICT FILE ACCESS TO` and merge its objects into their own repository to access the contents.

A credential exposure issue exists in the Strapi, SeaTable, and Mailcheck nodes. These nodes transmit decrypted credentials to the authentication endpoint using a raw legacy HTTP helper without proper error handling, which results in plaintext secrets being stored within execution error data. An authenticated user can retrieve these plaintext secrets from their own execution via the REST API, bypassing the redaction mechanisms of the credentials API.

A stored cross-site scripting issue exists in the Form node completion page. The system only applied its sandboxing Content-Security-Policy (a security layer that helps detect and mitigate certain types of attacks, including XSS) when the `respondWith` variable was not set to 'redirect'. However, the `responseText` variable was always rendered as raw HTML. An authenticated member could use an expression to set `respondWith` to 'redirect' while keeping `responseText` populated, leading the completion page to serve unsanitized HTML and scripts from the n8n origin. Consequently, any visitor submitting the public form would execute that script within their own session.

An expression injection issue exists in the link preview rendering of the `resource-locator` field. The editor directly splices the stored value of this field into the URL template of the node type without validating expression syntax. This allows an authenticated member to store a malicious value that, when viewed by another user in the editor, executes the injected expression as JavaScript within the victim's authenticated session, leading to cross-user script execution.

The GraphQL node fails to properly handle connection-level errors, re-throwing the underlying HTTP client error without wrapping it in the standard error type. This error includes the live request headers, which contain a decrypted credential secret. Because the execution engine persists this data verbatim, any authenticated user with access to the execution logs can retrieve the decrypted credential secret.