Homepage

n8n-nodes-base@1.121.47

Base nodes of n8n

  • latest version

    2.15.1

  • first published

    7 years ago

  • latest version published

    6 months ago

  • licenses detected

  • View n8n-nodes-base package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the n8n-nodes-base package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • L
    Server-side Request Forgery (SSRF)

    n8n-nodes-base is a Base nodes of n8n

    Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the OAuth2 authorization-code-to-access-token exchange, which issues its request through a separate HTTP client that lacks the SSRF guard applied to the discovery and dynamic-client-registration requests. A user able to create credentials can make the instance send token-exchange POST requests to internal addresses and read the reflected response body, by pointing a credential's access-token URL at an internal target and completing the OAuth2 flow. The request method, headers, and body are fixed beyond the OAuth2 fields, so disclosure is bounded to targets that respond usefully to that particular request shape.

    How to fix Server-side Request Forgery (SSRF)?

    Upgrade n8n-nodes-base to version 2.34.1 or higher.

    <2.34.1
    • H
    SQL Injection

    n8n-nodes-base is a Base nodes of n8n

    Affected versions of this package are vulnerable to SQL Injection in the postgres and timescaleDb nodes, which incorporate node parameters into database queries without adequate parameterization. A user with permission to create or modify workflows can execute arbitrary SQL against the connected database, within the privileges of the configured database account, by supplying crafted parameters to either node. Exploitation requires an authenticated user with workflow edit permission, and the impact is bounded by the privileges of the account the node connects with.

    How to fix SQL Injection?

    Upgrade n8n-nodes-base to version 2.25.2, 2.26.1 or higher.

    <2.25.2>=2.26.0 <2.26.1
    • M
    SQL Injection

    n8n-nodes-base is a Base nodes of n8n

    Affected versions of this package are vulnerable to SQL Injection through the prepareItems logic used by the findOneAndReplace, findOneAndUpdate, and update operations in GenericFunctions.ts and MongoDb.node.ts. An authenticated workflow editor can supply a non-scalar updateKey value, such as an object or array, enabling the node to build a MongoDB query filter from attacker-controlled input. This lets the attacker match unintended documents and overwrite them with content of their choosing. For users running affected workflows, this can corrupt or replace data in MongoDB collections without the node rejecting the malicious filter value.

    Workarounds

    • Limit workflow creation and editing permissions to fully trusted users only; this prevents authenticated workflow editors from supplying a malicious updateKey value in the MongoDB node’s Find And Replace path.
    • Disable the MongoDB node by adding n8n-nodes-base.mongoDb to the NODES_EXCLUDE environment variable; this blocks use of the vulnerable MongoDB node operations entirely.

    How to fix SQL Injection?

    Upgrade n8n-nodes-base to version 2.24.0 or higher.

    <2.24.0
    • H
    Prototype Pollution

    n8n-nodes-base is a Base nodes of n8n

    Affected versions of this package are vulnerable to Prototype Pollution via the Microsoft SQL node’s createTableStruct and related table-grouping logic in MicrosoftSql.node.ts and GenericFunctions.ts. An authenticated user who can create or modify workflows can trigger it by supplying a crafted table parameter such as __proto__, constructor, or prototype when configuring the Microsoft SQL node. That attacker-controlled table name is used as an object key in plain objects, allowing inherited properties on Object.prototype to be polluted process-wide for the life of the n8n server process. The result is application-wide validation failures and a broken n8n instance that remains non-functional until restarted.

    Workarounds

    • Limit workflow creation and editing permissions to fully trusted users only; this prevents untrusted authenticated users from supplying crafted table values through the Microsoft SQL node.
    • Disable the Microsoft SQL node by adding n8n-nodes-base.microsoftSql to the NODES_EXCLUDE environment variable; this blocks the vulnerable node from being used to trigger the prototype-pollution path.

    How to fix Prototype Pollution?

    Upgrade n8n-nodes-base to version 2.24.0 or higher.

    <2.24.0
    • M
    Exposure of Data Element to Wrong Session

    n8n-nodes-base is a Base nodes of n8n

    Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session via the combineBySql Merge-node SQL Query path in combineBySql.ts. An authenticated attacker can poison the shared SQL sandbox by supplying a workflow that runs attacker-controlled SQL, causing prototype mutations to persist into later Merge SQL executions on the same instance. This allows the attacker to intercept data processed by other users’ workflows, breaking the isolation of workflow execution in multi-user n8n instances.

    Notes

    • This only affects multi-user n8n deployments where more than one user can create or execute workflows using Merge node SQL Query mode; single-user instances do not have the same cross-user persistence issue.
    • The vulnerable path is the cached shared SQL sandbox used by repeated Merge SQL executions, so pollution can persist across later runs on the same instance rather than being limited to a single workflow execution.

    Workarounds

    • Limit workflow creation and editing permissions to fully trusted users only.
    • Disable the Merge node by adding n8n-nodes-base.merge to the NODES_EXCLUDE environment variable.

    How to fix Exposure of Data Element to Wrong Session?

    Upgrade n8n-nodes-base to version 2.25.2, 2.26.5 or higher.

    <2.25.2>=2.26.0 <2.26.5
    • H
    Improper Handling of Highly Compressed Data (Data Amplification)

    n8n-nodes-base is a Base nodes of n8n

    Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) via the Decompress operation in the Compression node. An attacker can cause the process to terminate and disrupt all workflows by sending a specially crafted compressed archive to a public webhook workflow, leading to memory exhaustion.

    How to fix Improper Handling of Highly Compressed Data (Data Amplification)?

    Upgrade n8n-nodes-base to version 2.23.0 or higher.

    <2.23.0
    • M
    Cross-site Scripting (XSS)

    n8n-nodes-base is a Base nodes of n8n

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the webhook verification endpoints in the Meta, WhatsApp and Microsoft Teams trigger nodes, where a query parameter is reflected into the HTTP response without proper sanitization or Content-Security-Policy headers. An attacker can execute arbitrary JavaScript in the context of a logged-in user's browser by convincing the user to visit a specially crafted URL.

    How to fix Cross-site Scripting (XSS)?

    Upgrade n8n-nodes-base to version 2.24.0 or higher.

    <2.24.0
    • M
    Directory Traversal

    n8n-nodes-base is a Base nodes of n8n

    Affected versions of this package are vulnerable to Directory Traversal via the ExecuteWorkflow node's localFile source option. An attacker can enumerate arbitrary files on the server host and in some instances can achieve arbitrary code execution by uploading a specially crafted file to the host.

    How to fix Directory Traversal?

    Upgrade n8n-nodes-base to version 2.19.3 or higher.

    <2.19.3
    • C
    Prototype Pollution

    n8n-nodes-base is a Base nodes of n8n

    Affected versions of this package are vulnerable to Prototype Pollution via the pagination parameter in the HTTP Request node. An attacker can execute arbitrary code on the instance by achieving global prototype pollution and chaining this with other techniques. This is only exploitable if the attacker is an authenticated user with permission to create or modify workflows.

    How to fix Prototype Pollution?

    Upgrade n8n-nodes-base to version 2.20.4, 2.21.1 or higher.

    <2.20.4>=2.21.0 <2.21.1
    • C
    Prototype Pollution

    n8n-nodes-base is a Base nodes of n8n

    Affected versions of this package are vulnerable to Prototype Pollution in the Xml class, which implements an XML node. A user with permission to create or modify workflows can achieve remote code execution on the host system.

    Note: This is a bypass of the fix for the vulnerability described in CVE-2026-42232.

    How to fix Prototype Pollution?

    Upgrade n8n-nodes-base to version 2.20.4, 2.21.1 or higher.

    <2.20.4>=2.21.0 <2.21.1
    • M
    SQL Injection

    n8n-nodes-base is a Base nodes of n8n

    Affected versions of this package are vulnerable to SQL Injection via the MySQL, PostgreSQL, and Microsoft SQL nodes due to improper escaping of identifier values. An attacker can execute arbitrary SQL commands by supplying specially crafted table or column names through node configuration parameters.

    How to fix SQL Injection?

    Upgrade n8n-nodes-base to version 2.4.0 or higher.

    <2.4.0
    • H
    Exposure of Sensitive System Information to an Unauthorized Control Sphere

    n8n-nodes-base is a Base nodes of n8n

    Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere due to insufficient restrictions in the Python Code node sandbox. An attacker can access sensitive files or execute arbitrary code by escaping the sandbox environment.

    How to fix Exposure of Sensitive System Information to an Unauthorized Control Sphere?

    Upgrade n8n-nodes-base to version 2.7.0 or higher.

    <2.7.0
    • C
    Protection Mechanism Failure

    n8n-nodes-base is a Base nodes of n8n

    Affected versions of this package are vulnerable to Protection Mechanism Failure via the Python Code node. An attacker can execute arbitrary code outside the intended security boundary by leveraging authenticated access and enabling Task Runners with Python support. This is only exploitable if Task Runners are enabled (N8N_RUNNERS_ENABLED=true), Python support is enabled (N8N_PYTHON_ENABLED=true), and the Code Node is enabled (default: true).

    How to fix Protection Mechanism Failure?

    Upgrade n8n-nodes-base to version 2.3.0 or higher.

    <2.3.0
    • C
    Remote Code Execution (RCE)

    n8n-nodes-base is a Base nodes of n8n

    Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to insufficient isolation in the Python Code Node that uses Pyodide. An authenticated attacker with permissions to create or modify workflows can execute arbitrary commands on the host system by creating or modifying workflows with malicious code.

    How to fix Remote Code Execution (RCE)?

    Upgrade n8n-nodes-base to version 2.0.0-rc.1 or higher.

    >=1.0.0 <2.0.0-rc.1
    • H
    Command Injection

    n8n-nodes-base is a Base nodes of n8n

    Affected versions of this package are vulnerable to Command Injection via the Execute Command node. An attacker can execute arbitrary commands on the host system by leveraging access to an authenticated user account, potentially leading to data exfiltration, service disruption, or full system compromise.

    Note:

    This is only exploitable if the Execute Command node is enabled and not all user accounts are strictly controlled and trusted.

    This issue does not impact n8n.cloud.

    As per maintainers' memo: "No code changes have been made to alter the behavior of the Execute Command node. The recommended mitigation is to disable the node by default in environments where it is not explicitly required. Future n8n versions may change the default availability of this node."

    ##Workaround

    This vulnerability can be mitigated by disabling the Execute Command node before n8n start using the environment variable: export NODES_EXCLUDE: "[\"n8n-nodes-base.executeCommand\"]".

    How to fix Command Injection?

    There is no fixed version for n8n-nodes-base.

    >=0.1.0
    Go back to all versions of this package