If you discover a (suspected) security vulnerability, please report it through our Vulnerability Disclosure Program.
Security: n8n-io/n8n
Security
SECURITY.md
-
XML Node Prototype Pollution Patch BypassGHSA-wrwr-h859-xh2r published
May 13, 2026 by JubkeCritical -
Source Control Pull SQL InjectionGHSA-mhrx-qhrj-673w published
May 13, 2026 by JubkeHigh -
Cross-user Authorization Bypass in Dynamic Credential OAuth EndpointsGHSA-6h4j-wcr9-2vg7 published
May 13, 2026 by JubkeHigh -
HTTP Request Node Pagination Prototype Pollution to RCEGHSA-c8xv-5998-g76h published
May 13, 2026 by JubkeCritical -
Arbitrary File Read via Git NodeGHSA-57g9-58c2-xjg3 published
May 13, 2026 by JubkeCritical -
XML Node Prototype Pollution to RCEGHSA-hqr4-h3xv-9m3r published
Apr 22, 2026 by JubkeCritical -
RCE via SQL Mode of Merge NodeGHSA-58qr-rcgv-642v published
Mar 25, 2026 by JubkeCritical -
Prototype Pollution in XML Webhook Body Parser Leads to RCEGHSA-q5f4-99jv-pgg5 published
Apr 22, 2026 by JubkeCritical -
Credential exfiltration via Allowed HTTP Request Domains BypassGHSA-3875-8gcx-7v46 published
May 13, 2026 by JubkeModerate -
XSS via MCP OAuth clientGHSA-537j-gqpc-p7fq published
Apr 22, 2026 by JubkeHigh
Learn more about advisories related to n8n-io/n8n in the GitHub Advisory Database