Yuvalo1212

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 2.10.1 n8n versions prior to 2.9.3 n8n versions prior to 1.123.22 **Description** An authenticated user with permissions to create or modify workflows can abuse crafted expressions within workflow parameters to trigger unintended system command execution on the host running the platform. This occurs because expressions supplied during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime, allowing for a sandbox escape. Successful exploitation can lead to a full compromise of the instance, including unauthorized access to sensitive data and execution of system-level operations with the privileges of the n8n process. **Recommendations** Update to version 2.10.1 or later. Update to version 2.9.3 or later. Update to version 1.123.22 or later. Limit workflow creation and editing permissions to fully trusted users only. Deploy the software in a hardened environment with restricted operating system privileges and network access.

**Name of the Vulnerable Software and Affected Versions** Cursor versions prior to 0.42 **Description** The issue allows an attacker with control over a malicious web page to influence a language model to output arbitrary commands for execution in the user's terminal. This scenario requires the user to explicitly opt-in to including the contents of a compromised webpage and the attacker to display prompt injection text in the contents of the compromised webpage. A server-side patch was released on September 27, 2024, to prevent the streaming of newlines or control characters. **Recommendations** For versions prior to 0.42, no additional action is needed as the patch has been applied server-side. For all versions, it is recommended to set the `"cursor.terminal.usePreviewBox"` setting to true to stream responses into a preview box, which requires manual acceptance before being inserted into the terminal. As a best practice, only include trusted pieces of context in prompts.