Sm1Ee

n8n before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a flaw in the OAuth2 credential callback of the dynamic-credential connect flow, which does not verify that the completing browser belongs to the user who started the flow. Members with access to a resolvable OAuth2 credential can send the provider authorization URL to a victim; if the victim consents without an active n8n session, the victim's tokens are stored under the member's identity, letting the member's workflows act as the victim.

n8n before 2.46.1 contains an arbitrary file read vulnerability that allows authenticated members to read server files by supplying absolute paths to the Browser Use browser upload tool. Attackers with a connected remote browser session can have Playwright read files such as instance configuration from the n8n server and retrieve their contents from the page.

The software passes the full execution context of a failed workflow, including the identity of the user who initiated the run, to the configured error workflow. This allows a project editor to set the `settings.errorWorkflow` of a colleague's workflow to an error workflow they own. Consequently, the editor can inherit the colleague's identity upon workflow failure and resolve the colleague's per-user dynamic credential secrets.

An OData $filter injection issue exists in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes. These nodes construct $filter string literals from expression-bindable parameters without proper escaping. This allows attackers providing untrusted input to inject single quotes, potentially enabling them to dump the entire contact list of the bound mailbox or redirect SharePoint writes to unintended list items within the scope of the stored credentials.

Credential secrets are stored in execution error data when operations fail within the Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes. This allows users with permissions to view workflow executions, but without permissions to read credentials, to recover Git passwords or tokens, MongoDB database passwords, or Google access tokens.

A prototype pollution issue exists in the MCP workflow-validation tool. The interpreter evaluates caller-supplied code in the main process, reads inherited properties, and allows assignment to shared prototypes. An authenticated user with `workflow:read` permissions can replace a built-in method to return a truthy value, causing server-side permission checks to accept unauthorized scopes. This can lead to the takeover of owner accounts that do not have multi-factor authentication (MFA) enabled.

The software fails to validate credential IDs stored in agent node parameters when an editor saves a shared workflow, as the validation process only inspects the credentials field of a node. This allows an editor to configure a Message an Agent node in inline mode using tools under their control to resolve the owner's credentials and transmit decrypted secrets to an external destination.

An authorization bypass exists in the Agents create endpoint. The system accepts a caller-supplied Agent ID and verifies permissions only against the requested project, failing to verify which project actually owns the Agent. This allows an authenticated user with read-only Agent access to another project to provide an existing Agent ID to move that Agent into their own project and modify its name, schema, and version.

A buffer overflow exists in PDFium, a PDF rendering engine, within Google Chrome on Windows. A remote attacker could use social engineering to trick a user into opening a specially crafted PDF file, potentially leading to arbitrary code execution inside the sandbox.

A security issue exists that allows attackers to affect the system.

A use after free issue exists in the PDF component. This flaw allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to open a specially crafted HTML page. Use after free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed.

The PostgresTrigger node fails to properly escape user-supplied identifier parameters when interpolating them into SQL statements. This allows an authenticated user to perform a SQL injection, executing arbitrary SQL commands against the connected PostgreSQL database using the privileges of the configured credentials, which can result in full read and write access. The affected parameters are `channel`, `function`, and `trigger names`.

An authenticated user with workflow edit access can provide a malicious filter value within the MongoDB node's Find And Replace operation. Because the value is not validated before being used as a query filter in MongoDB, it allows unintended documents to be matched and overwritten with content controlled by the attacker.

An authenticated user with workflow edit access can inject arbitrary JavaScript into the page generated by the Chat Trigger by providing a malicious `webhookId`. This allows the injected code to execute within the n8n origin using the session privileges of any logged-in user who visits the chat URL.

An endpoint in the Meta and Microsoft Teams trigger nodes reflects a query parameter into the HTTP response without sanitization or Content-Security-Policy headers. This allows for reflected Cross-Site Scripting (XSS), where an attacker can execute malicious scripts in the n8n origin if a logged-in user visits a specially crafted URL.

A prototype pollution issue allows a crafted public webhook payload to inject attacker-controlled fields into workflow data during internal object copying. Prototype pollution occurs when an attacker can manipulate the prototype of an object, potentially altering the behavior of the application. These injected fields can be consumed as normal values by downstream built-in nodes. In workflows combining a public webhook with action nodes, this can lead to a confused deputy scenario, where the workflow targets unintended records or issues outbound requests using the workflow owner's configured credentials.

An authenticated user with permissions to create or modify workflows can provide crafted parameters to the TimescaleDB and legacy Postgres v1 nodes. This allows arbitrary SQL injection and execution against the connected database, operating under the privileges of the configured database account.

An authenticated user with permissions to create or modify workflows can pollute the sandbox used by the Merge node's SQL Query mode. Since the sandbox context is cached and reused across all workflow executions on an instance, prototype mutations introduced by one user persist in subsequent Merge SQL executions for other users or projects. This allows a low-privileged attacker to intercept workflow data processed by other users on the same instance. This issue specifically affects multi-user instances where multiple users have permission to create and execute workflows using the Merge node in SQL Query mode.

An authenticated user with permissions to create or modify workflows can achieve global prototype pollution through an unvalidated pagination parameter in the HTTP Request node. Prototype pollution occurs when an application allows an attacker to modify the prototype of a base object, potentially altering the behavior of all objects created from that prototype. This issue can be combined with other techniques to result in Remote Code Execution (RCE) on the instance.

An attacker with write access to a git repository connected to an n8n Source Control configuration can commit a malicious Data Table JSON file containing a crafted column name. When an administrator performs a Source Control Pull, the application imports the file, which can lead to SQL injection on the internal PostgreSQL instance. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution. This issue requires the instance to use PostgreSQL as its database backend, the Source Control feature to be enabled and connected to a repository the attacker can write to, and an administrator to trigger the Source Control Pull.