CVE Vulnerability Catalog

n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorization check. A user holding only the narrow role:manageProject global scope could delete any custom project role in use on the instance and reassign its holders (including themselves) to the built-in project:admin role, gaining full administrative control of projects they had no legitimate access to.

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit prototype pollution to execute arbitrary commands within the runner container. Because the polluted prototype is a process-wide object, the corruption persists across other tenants' Code node executions on the same shared runner. On v1.x instances without task runners enabled, Code node JavaScript runs directly in the main n8n process, where the impact could be higher.

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resource-locator field link preview rendering. The editor spliced the field's stored value directly into the node type's URL template without checking for expression syntax. An authenticated member can store a malicious value so that when another user opens the affected node in the editor, the injected expression is evaluated as JavaScript in the victim's authenticated session (cross-user script execution).

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completion page. The completion page applied its sandboxing Content-Security-Policy only when respondWith was not set to 'redirect', but responseText was always rendered as raw HTML. An authenticated member could set respondWith to 'redirect' via an expression while keeping responseText populated, causing the completion page to serve unsanitized HTML and script from the n8n origin. Any visitor who submitted the resulting public form would have that script execute same-origin with their session.

n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability in the @n8n/workflow-sdk node-schema loader used for MCP node-schema loading. The loader derives a node's schema module path directly from the attacker-supplied node type string without validating path-traversal sequences. An authenticated user with global:member privileges can reference malicious files via path traversal, causing code execution in the n8n main process.

Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions. This means that a person without authentication can access resources or functions that should be protected.

Unauthenticated Broken Access Control vulnerability in Koji versions up to 2.2.1. An attacker without authentication can gain unauthorized access to protected functions.

Unauthenticated Broken Access Control vulnerability in EPROLO Dropshipping plugin versions up to 2.4.2. An attacker without authentication can access administrative or other protected resources.

SQL Injection vulnerability in eShipper Commerce plugin versions up to 2.16.13, exploitable by a user with Subscriber role. A low-privileged user can inject SQL queries into the database.

SQL Injection vulnerability in WP w3all phpBB plugin versions up to 3.0.5, exploitable by a user with Subscriber role. A low-privileged user can inject SQL queries into the database.

Unauthenticated Cross Site Scripting (XSS) vulnerability in NotificationX Pro plugin versions up to 3.1.4. An attacker without authentication can inject a malicious script into the page, which executes in the victim's browser.

Broken Authentication vulnerability in Leyka plugin versions up to 3.32.3, exploitable by a user with Subscriber role. A low-privileged user can bypass authentication mechanisms and gain unauthorized access.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Flatastic theme versions up to 2.0. An attacker without authentication can inject a malicious script into the page, which executes in the victim's browser.

The Form Maker by 10Web plugin (versions up to 1.15.49) is vulnerable to Stored Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. Malicious JavaScript submitted through a form is stored and executed when a user visits the affected page.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Podlove Podcast Publisher plugin versions up to 4.5.4. An attacker without authentication can inject a malicious script into the page, which executes in the victim's browser.

Unauthenticated Cross Site Scripting (XSS) vulnerability in SEO Plugin by Squirrly SEO plugin versions up to 14.2.2. An attacker without authentication can inject a malicious script into the page, which executes in the victim's browser.

Unauthenticated Cross Site Scripting (XSS) in Aora versions up to 1.3.19. An attacker can inject malicious script without authentication.

Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce versions up to 4.1.10. An attacker can inject malicious script without authentication.

Unauthenticated Cross Site Scripting (XSS) in Advance Product Search versions up to 1.4.8. An attacker can inject malicious script without authentication.

Unauthenticated Cross Site Scripting (XSS) in SmartSMTP versions up to 1.2.0. An attacker can inject malicious script without authentication.