GHSA-xmc9-4f2h-jf9c: n8n: Edit Image Node Format Injection Allows Arbitrary File Write
The n8n Edit Image node passed its output format to the underlying image library without validation, so a crafted value could write bytes to a location outside the node’s working directory. An authenticated user able to run workflows could use this to write arbitrary files in the n8n instance.
References
- github.com/advisories/GHSA-xmc9-4f2h-jf9c
- github.com/n8n-io/n8n/commit/f69dfc6dd2178a14ea1624d2e1d403c2e755042f
- github.com/n8n-io/n8n/releases/tag/n8n@1.123.67
- github.com/n8n-io/n8n/releases/tag/n8n@2.31.5
- github.com/n8n-io/n8n/releases/tag/n8n@2.32.1
- github.com/n8n-io/n8n/security/advisories/GHSA-xmc9-4f2h-jf9c
Code Behaviors & Features
Detect and mitigate GHSA-xmc9-4f2h-jf9c with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →