n8n: Expression sandbox escape via arrow-function bodies enabling command execution
Affects: n8n
Advisories
Security advisories for popular AI software, newest first, each linked to its public source.
727 advisories
n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion
Affects: n8n
n8n: Authenticated code execution in the n8n Git node
Affects: n8n
n8n: SSRF Protection Bypass via MCP Client Node
Affects: n8n
n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction
Affects: n8n
n8n: Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM Nodes
Affects: n8n
n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login
Affects: n8n
n8n: Google Service Account Private Key Exposed in JWT Header
Affects: n8n
n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution
Affects: n8n
n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview
Affects: n8n
n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction
Affects: n8n
n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token…
Affects: n8n
n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth…
Affects: n8n
n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access
Affects: n8n
n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`
Affects: n8n
n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution
Affects: n8n
n8n: Computer-use Shell Sandbox Not Enforced on Linux and Windows
Affects: n8n
n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data
Affects: n8n
n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner
Affects: n8n
n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool
Affects: n8n
n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook
Affects: n8n
Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data
Affects: Keras
Langflow: IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to…
Affects: Langflow
Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution due to…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to execute…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain…
Affects: Langflow
vLLM: Processing differential in multi-channel audio downmixing enables hidden-input/moderation bypass…
Affects: vLLM
n8n: External Secrets Permission Bypass via Expression Parser Mismatch
Affects: n8n
Open WebUI: Open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing…
Affects: Open WebUI
Open WebUI: Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth…
Affects: Open WebUI
n8n: N8n contains an authentication bypass in the Chat Trigger node when configured with n8n User…
Affects: n8n
NVIDIA Triton Inference Server: NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause…
Affects: NVIDIA Triton Inference Server
Keras: Tar extraction permits symlink-based path traversal
Affects: Keras
Ollama: Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability
Affects: Ollama
Flowise: Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT…
Affects: Flowise
n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads
Affects: n8n