Homepage

n8n-workflow@1.120.27

Workflow base code of n8n

  • latest version

    2.16.0

  • latest non vulnerable version

    2.36.2

  • first published

    7 years ago

  • latest version published

    4 months ago

  • licenses detected

  • View n8n-workflow package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the n8n-workflow package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Arbitrary Code Injection

    n8n-workflow is a Workflow base code of n8n

    Affected versions of this package are vulnerable to Arbitrary Code Injection via crafted expressions using arrow functions in the expression. An attacker can execute arbitrary system commands by bypassing the intended sandbox restrictions.

    Note: This is only exploitable if the attacker is an authenticated user with permission to create or modify workflows.

    How to fix Arbitrary Code Injection?

    Upgrade n8n-workflow to version 2.31.3, 2.32.1 or higher.

    <2.31.3>=2.32.0 <2.32.1
    • M
    Prototype Pollution

    n8n-workflow is a Workflow base code of n8n

    Affected versions of this package are vulnerable to Prototype Pollution via the deepCopy and replaceCircularReferences utilities in utils.ts. An attacker can inject crafted __proto__, constructor, or prototype fields in a public webhook payload that is copied into workflow data, causing those fields to be treated as normal values by downstream nodes. This can cause workflows to act on attacker-controlled data as if it were trusted input, leading to confused-deputy behavior, such as targeting unintended records or issuing outbound requests using the workflow owner’s credentials.

    Workarounds

    • Avoid exposing public (unauthenticated) webhook workflows that pass incoming data through transform nodes into action nodes that use sensitive credentials or database operations; this limits the confused-deputy attack path from attacker-supplied webhook payloads.
    • Limit workflow creation and editing permissions to fully trusted users only; this reduces the chance that an attacker can introduce or modify a workflow that combines a public webhook with sensitive downstream actions.

    How to fix Prototype Pollution?

    Upgrade n8n-workflow to version 2.25.2, 2.26.1 or higher.

    <2.25.2>=2.26.0 <2.26.1
    • C
    Remote Code Execution (RCE)

    n8n-workflow is a Workflow base code of n8n

    Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to insufficient isolation in the Python Code Node that uses Pyodide. An authenticated attacker with permissions to create or modify workflows can execute arbitrary commands on the host system by creating or modifying workflows with malicious code.

    How to fix Remote Code Execution (RCE)?

    Upgrade n8n-workflow to version 2.0.0-rc.1 or higher.

    >=1.0.0 <2.0.0-rc.1
    Go back to all versions of this package