GHSA-xmc9-4f2h-jf9c: n8n: Edit Image Node Format Injection Allows Arbitrary File Write
The n8n Edit Image node passed its output format to the underlying image library without validation, so a crafted value could write bytes to a location outside the node’s working directory. An authenticated user able to run workflows could use this to write arbitrary files in the n8n instance.
References
- github.com/advisories/GHSA-xmc9-4f2h-jf9c
- github.com/n8n-io/n8n/commit/f69dfc6dd2178a14ea1624d2e1d403c2e755042f
- github.com/n8n-io/n8n/releases/tag/n8n@1.123.67
- github.com/n8n-io/n8n/releases/tag/n8n@2.31.5
- github.com/n8n-io/n8n/releases/tag/n8n@2.32.1
- github.com/n8n-io/n8n/security/advisories/GHSA-xmc9-4f2h-jf9c
Code Behaviors & Features
Detect and mitigate GHSA-xmc9-4f2h-jf9c with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →