Snyk Security Database

n8n-nodes-base is a Base nodes of n8n

Affected versions of this package are vulnerable to Eval Injection. An attacker can execute arbitrary code on the host system by submitting specially crafted form data that is interpreted as an expression.

Note:

This is only exploitable if a workflow contains a form node with a field that interpolates unauthenticated user input and the field value begins with an '=' character, causing double evaluation of the content.

polyutil is a malicious package. that utilizes typosquatting to infiltrate developer environments via PyPI. Once installed, it executes obfuscated payloads designed to harvest sensitive data, including environment variables, cloud credentials, and SSH keys. This stolen information is exfiltrated to a command-and-control server. The campaign is particularly dangerous due to its use of delayed execution and professional-looking documentation to evade detection and deceive developers.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the DefaultLevelDBSerializer class. An attacker can execute arbitrary code by injecting a crafted serialized Java object into the LevelDB database files, which is then deserialized during normal aggregation repository operations.