Masofgon

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.73 n8n versions prior to 2.35.4 n8n versions prior to 2.36.2 **Description** A credential exposure issue exists in the Strapi, SeaTable, and Mailcheck nodes. These nodes transmit decrypted credentials to the authentication endpoint using a raw legacy HTTP helper without proper error handling, which results in plaintext secrets being stored within execution error data. An authenticated user can retrieve these plaintext secrets from their own execution via the REST API, bypassing the redaction mechanisms of the credentials API. **Recommendations** Update to version 1.123.73 or later. Update to version 2.35.4 or later. Update to version 2.36.2 or later.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.69 n8n versions prior to 2.33.4 n8n versions prior to 2.34.1 **Description** A stored cross-site scripting issue exists in the Form node completion page. The system only applied its sandboxing Content-Security-Policy (a security layer that helps detect and mitigate certain types of attacks, including XSS) when the `respondWith` variable was not set to 'redirect'. However, the `responseText` variable was always rendered as raw HTML. An authenticated member could use an expression to set `respondWith` to 'redirect' while keeping `responseText` populated, leading the completion page to serve unsanitized HTML and scripts from the n8n origin. Consequently, any visitor submitting the public form would execute that script within their own session. **Recommendations** Update n8n to version 1.123.69 or later. Update n8n to version 2.33.4 or later. Update n8n to version 2.34.1 or later.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.69 n8n versions 2.x prior to 2.33.4 n8n versions 2.34.x prior to 2.34.1 **Description** An expression injection issue exists in the link preview rendering of the `resource-locator` field. The editor directly splices the stored value of this field into the URL template of the node type without validating expression syntax. This allows an authenticated member to store a malicious value that, when viewed by another user in the editor, executes the injected expression as JavaScript within the victim's authenticated session, leading to cross-user script execution. **Recommendations** Update to version 1.123.69 or later. Update to version 2.33.4 or later for the 2.x branch. Update to version 2.34.1 or later for the 2.34.x branch.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.69 n8n versions prior to 2.33.4 n8n versions prior to 2.34.1 **Description** The GraphQL node fails to properly handle connection-level errors, re-throwing the underlying HTTP client error without wrapping it in the standard error type. This error includes the live request headers, which contain a decrypted credential secret. Because the execution engine persists this data verbatim, any authenticated user with access to the execution logs can retrieve the decrypted credential secret. **Recommendations** Update to version 1.123.69 or later. Update to version 2.33.4 or later. Update to version 2.34.1 or later.