n8n-nodes-base@1.121.5 vulnerabilities
Base nodes of n8n
latest version
1.121.15
first published
6 years ago
latest version published
4 days ago
licenses detected
- >=0
Direct Vulnerabilities
Known vulnerabilities in the n8n-nodes-base package. This does not include vulnerabilities belonging to this package’s dependencies.
Fix vulnerabilities automatically
Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to User Impersonation via the How to fix User Impersonation? Upgrade | <1.121.12>=2.0.0 <2.4.6>=2.6.0 <2.6.1 |
n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to SQL Injection via the MySQL, PostgreSQL, and Microsoft SQL nodes due to improper escaping of identifier values. An attacker can execute arbitrary SQL commands by supplying specially crafted table or column names through node configuration parameters. How to fix SQL Injection? Upgrade | <2.4.0 |
n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to User Impersonation via the How to fix User Impersonation? Upgrade | <1.121.9>=2.0.0 <2.5.0 |
n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the workflow creation and editing process in various nodes, including Form Trigger, Chat Trigger, Send & Wait, Webhook, and Chat nodes. An attacker can execute arbitrary scripts in the browsers of users who visit affected pages by injecting malicious payloads, potentially leading to session hijacking and account takeover. How to fix Cross-site Scripting (XSS)? Upgrade | <1.121.15>=2.0.0 <2.9.1>=2.10.0 <2.10.1 |
n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Eval Injection. An attacker can execute arbitrary code on the host system by submitting specially crafted form data that is interpreted as an expression. Note: This is only exploitable if a workflow contains a form node with a field that interpolates unauthenticated user input and the field value begins with an '=' character, causing double evaluation of the content. How to fix Eval Injection? Upgrade | <1.121.15>=2.0.0 <2.9.1>=2.10.0 <2.10.1 |
n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere due to insufficient restrictions in the How to fix Exposure of Sensitive System Information to an Unauthorized Control Sphere? Upgrade | <2.7.0 |
n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Arbitrary Code Injection via the How to fix Arbitrary Code Injection? Upgrade | <1.121.15>=2.0.0 <2.9.1>=2.10.0 <2.10.1 |
n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Protection Mechanism Failure via the Python Code node. An attacker can execute arbitrary code outside the intended security boundary by leveraging authenticated access and enabling Task Runners with Python support. This is only exploitable if Task Runners are enabled ( How to fix Protection Mechanism Failure? Upgrade | <2.3.0 |
n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Command Injection via the How to fix Command Injection? Upgrade | <1.121.11>=2.0.0-rc.0 <2.5.2 |
n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Arbitrary File Upload via the Merge node's SQL Query mode. An attacker can write arbitrary files to the server's filesystem and potentially execute remote code by crafting malicious workflows. Note: This is only exploitable if the attacker has authenticated access with permissions to create or modify workflows. How to fix Arbitrary File Upload? Upgrade | <1.121.12>=2.0.0 <2.4.0 |
n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Directory Traversal via the SSH node when workflows process uploaded files and transfer them to remote servers without validating their metadata. An attacker can write files to unintended locations on remote systems and potentially achieve remote code execution by uploading specially crafted files to unauthenticated endpoints. Note: This is only exploitable if the attacker has knowledge of such workflows and the endpoints for file uploads are unauthenticated. How to fix Directory Traversal? Upgrade | <1.121.7>=2.0.0 <2.3.2 |
n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Permissive List of Allowed Inputs in the Webhook Node's IP whitelist validation due to How to fix Permissive List of Allowed Inputs? Upgrade | >=1.36.0 <1.121.7>=2.0.0-rc.0 <2.2.0 |
n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to insufficient isolation in the Python Code Node that uses Pyodide. An authenticated attacker with permissions to create or modify workflows can execute arbitrary commands on the host system by creating or modifying workflows with malicious code. How to fix Remote Code Execution (RCE)? Upgrade | >=1.0.0 <2.0.0-rc.1 |
n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Command Injection via the Note: This is only exploitable if the This issue does not impact As per maintainers' memo: "No code changes have been made to alter the behavior of the Execute Command node. The recommended mitigation is to disable the node by default in environments where it is not explicitly required. Future n8n versions may change the default availability of this node." ##Workaround This vulnerability can be mitigated by disabling the How to fix Command Injection? There is no fixed version for | >=0.1.0 |