Fatihhcelik

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 2.2.0 n8n versions prior to 1.123.8 **Description** n8n is an open source workflow automation platform. An authenticated user with permission to create or modify workflows could chain the Read/Write Files from Disk node with git operations to achieve remote code execution. By writing to specific configuration files and then triggering a git operation, an attacker could execute arbitrary shell commands on the n8n host. The issue involves the interaction between the Read/Write Files from Disk node and git operations, potentially allowing an attacker to manipulate configuration files and subsequently execute commands. The `Read/Write Files from Disk` node and git operations are involved in the exploitation process. **Recommendations** Upgrade to n8n version 2.2.0 or later. Upgrade to n8n version 1.123.8 or later. If upgrading is not immediately possible, limit workflow creation and editing permissions to fully trusted users only. If upgrading is not immediately possible, disable the Read/Write Files from Disk node by adding `n8n-nodes-base.readWriteFile` to the `NODES EXCLUDE` environment variable.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.17 n8n versions prior to 2.5.2 **Description** n8n is an open-source workflow automation platform. An authenticated user with permission to create or modify workflows can exploit crafted expressions in workflow parameters to trigger system command execution on the host running n8n. This allows for potential full server compromise, including the theft of API keys, credentials, and secrets. The issue stems from an expression escape vulnerability and incomplete AST-based sanitization. Public exploits are available. **Recommendations** Upgrade to n8n version 1.123.17 or later. Upgrade to n8n version 2.5.2 or later. As a temporary workaround, limit workflow creation and editing permissions to fully trusted users only. Deploy n8n in a hardened environment with restricted operating system privileges and network access.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.10 n8n versions prior to 2.5.0 **Description** n8n, an open source workflow automation platform, contains a flaw in the Git node. This allows authenticated users with create or modify permissions for workflows to execute arbitrary system commands or read arbitrary files on the n8n host. The issue impacts systems where users have the ability to create or modify workflows. No information is available regarding the number of potentially affected devices worldwide or any real-world incidents of exploitation. The Git node is a component used for interacting with Git repositories. The `Git node` allows users to perform actions such as cloning, pulling, and pushing changes to Git repositories. **Recommendations** Upgrade to n8n version 1.123.10 or later. Upgrade to n8n version 2.5.0 or later. If upgrading is not immediately possible, limit workflow creation and editing permissions to fully trusted users only. If upgrading is not immediately possible, restrict or disable access to the Git node if it is not essential for operations. If upgrading is not immediately possible, deploy n8n in a hardened environment with restricted operating system privileges and network access.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 2.10.1 n8n versions prior to 2.9.3 n8n versions prior to 1.123.22 **Description** An authenticated user with permissions to create or modify workflows can abuse crafted expressions within workflow parameters to trigger unintended system command execution on the host running the platform. This occurs because expressions supplied during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime, allowing for a sandbox escape. Successful exploitation can lead to a full compromise of the instance, including unauthorized access to sensitive data and execution of system-level operations with the privileges of the n8n process. **Recommendations** Update to version 2.10.1 or later. Update to version 2.9.3 or later. Update to version 1.123.22 or later. Limit workflow creation and editing permissions to fully trusted users only. Deploy the software in a hardened environment with restricted operating system privileges and network access.

**Name of the Vulnerable Software and Affected Versions** n8n versions 0.211.0 through 1.120.3 n8n versions 1.121.0 through 1.121.0 n8n versions 1.122.0 (affected versions not specified) **Description** A critical Remote Code Execution (RCE) issue exists in the workflow expression evaluation system. Authenticated users can provide expressions during workflow configuration that are evaluated in an execution context insufficiently isolated from the underlying runtime. This allows an attacker to execute arbitrary code with the privileges of the n8n process, potentially leading to full instance compromise, unauthorized sensitive data access, and system-level operations. Approximately 24,700 unpatched instances are publicly accessible worldwide, primarily in North America and Europe. The Zerobot botnet has been observed exploiting this flaw to hijack automated workflows for malicious command execution. **Recommendations** Upgrade to versions 1.120.4, 1.121.1, or 1.122.0. Limit workflow creation and editing permissions to fully trusted users only. Deploy n8n in a hardened environment with restricted operating system privileges and network access.