Homepage

@n8n/db@0.34.42

  • latest version

    1.34.4

  • latest non vulnerable version

    1.35.3

  • first published

    1 years ago

  • latest version published

    3 days ago

  • licenses detected

  • View db package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @n8n/db package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Prototype Pollution

    Affected versions of this package are vulnerable to Prototype Pollution via workflow credential handling in the workflow API and authentication guard code. An authenticated user with workflow:create permission can save, update, or import a crafted workflow that pollutes Object.prototype, then trigger unauthenticated requests to be treated as authenticated by supplying polluted request state. This exposes privileged endpoints such as user and project listings to unauthenticated callers, leaking account details including email, role, and MFA status, and can corrupt global state so parts of the instance become unresponsive until restart.

    Notes

    • The workflow credential handling issue spans both saved workflows and imported workflows, so instances that accept user-supplied workflow JSON are in scope even if the attacker never edits a workflow through the UI.
    • The advisory’s unauthenticated enumeration impact is broader than user records: the maintainer note says all projects on the instance may be disclosed as well, so deployments that expose project-scoped data APIs inherit the same leak path.

    Workarounds

    • Restrict workflow creation and editing permissions to fully trusted users only; this limits who can submit crafted workflows that trigger the prototype-pollution path.
    • Restrict network access to the n8n instance to trusted users only; this reduces the chance that an attacker can reach the workflow API and exploit the issue.

    How to fix Prototype Pollution?

    Upgrade @n8n/db to version 1.28.1 or higher.

    <1.28.1
    • M
    Authorization Bypass Through User-Controlled Key

    Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the variables API endpoint when an authenticated user with a valid API key scoped to variable:list supplies an arbitrary projectId query parameter. An attacker can access sensitive variables in projects they are not members of by bypassing project membership checks.

    Note: This is only exploitable if the deployment is a team instance with multiple projects and the variables feature is enabled.

    How to fix Authorization Bypass Through User-Controlled Key?

    Upgrade @n8n/db to version 1.17.2, 1.18.1 or higher.

    <1.17.2>=1.18.0 <1.18.1
    Go back to all versions of this package