Tr4Ce-Ju

n8n before 1.123.89 contains a credential leakage vulnerability in the NocoDB node that sends the configured NocoDB API token to attacker-chosen hosts when downloading attachments. Attackers with write access to a NocoDB attachment cell can insert a URL to their host, capturing the API token when the workflow executes with Download Attachments enabled.

The Git node Log operation fails to strip a repository's local git configuration before invoking an external program. This allows authenticated members who can point the node, including when used as an agent tool, at a repository with a local configuration they control to execute programs as the n8n process user.

An authorization bypass allows authenticated members to spoof workflow identity when using the Execute Sub-workflow in inline JSON mode. By supplying a trusted identifier, an attacker can resolve credentials from projects to which they do not belong and modify the static data and error-workflow dispatch of another workflow.

A stored DOM cross-site scripting issue exists in the Resource Locator parameter dropdown link handling. Workflow authors can inject malicious script URLs into the `Resource Locator` parameter. This allows the execution of arbitrary JavaScript within the editor origin when another user opens the node dropdown and clicks the external-link icon. The malicious payload persists when workflows are shared or imported.

A path traversal issue exists in the signed resume URL generation for Send-and-Wait approvals. Users with workflow creation permissions can forge approval URLs for gates in projects they are not authorized to access. This is achieved by exploiting unresolved traversal sequences within caller-controlled node IDs, allowing for cross-project approval forgery.

An approval bypass exists in the Send and Wait node when using the Approve Within Chat mode. This allows unauthenticated users to submit resume requests without the system verifying the requester's identity or approval permissions, which can lead to the advancement of waiting executions and the triggering of guarded actions.

A PostgREST filter injection issue exists in the Supabase node during Row Get Many, Delete, and Update operations. The system constructs filter queries by concatenating expression-bindable values without proper escaping. This allows an attacker to inject conditions that expand the filter to match all rows, potentially resulting in full-table data disclosure, deletion, or modification.

A NoSQL injection issue exists in the MongoDB node's Find, Delete, and Aggregate operations. The software parses the `Query` parameter as JSON after expression resolution without sanitizing MongoDB operators. An attacker capable of influencing the resolved query through externally-controlled data can inject operators like `$ne` or `$where`. This can result in full-collection disclosure, full-collection deletion, or other unauthorized operations on the database server.

An authenticated user with permissions to create or modify workflows can bypass the `N8N RESTRICT FILE ACCESS TO` file sandbox. By providing a local filesystem path as the source repository in the Git node's Clone operation or as the target repository in the Push operation, the user can clone the contents of any local git repository accessible to the n8n process into an allowed path. This allows the reading of files that are otherwise blocked by direct file read access restrictions.

An authenticated user with permissions to create or modify workflows can exploit a flaw in the CSS sanitization of the Form Trigger node to store a cross-site scripting (XSS) payload. XSS is a type of security issue where malicious scripts are injected into trusted websites. The injected script executes persistently for every visitor of the published form, which enables phishing and the hijacking of form submissions. While the Content Security Policy prevents the theft of n8n session cookies, it does not stop script execution or the manipulation of form actions.

An authenticated user with the `global:member` role could exploit authorization flaws in n8n's credential pipeline to obtain plaintext secrets from generic HTTP credentials (`httpBasicAuth`, `httpHeaderAuth`, `httpQueryAuth`) belonging to other users on the same instance. The attack exploits a name-based credential resolution path that lacks ownership or project scope enforcement, combined with a bypass in the credentials permission checker that skips validation for generic HTTP credential types. This allows a user with the `global:member` role to resolve another user's credential ID and execute a workflow that decrypts and uses that credential without authorization. Native integration credential types (e.g., `slackApi`, `openAiApi`, `postgres`) are not affected. This issue impacts only the Community Edition of n8n.

BlackSheep, an asynchronous web framework for building event-based web applications with Python, has an issue in its HTTP Client implementation. Missing validation of headers allows an attacker to modify HTTP requests, potentially inserting new headers or creating entirely new requests. Exploitation requires passing unsanitized user input directly into headers. The server component is not affected as BlackSheep relies on an underlying ASGI server for handling response headers. The attack vector involves applications using user input in HTTP client requests related to the method, URL, or headers.