Critical
CVE-2026-25115
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 177
Reset filters
Critical
CVE-2026-25056
n8n Merge Node has Arbitrary File Write leading to RCE
High
CVE-2026-25055
n8n Vulnerable to Arbitrary File Write on Remote Systems via SSH Node
High
CVE-2026-25054
n8n Has Stored Cross-site Scripting via Markdown Rendering in Workflow UI
Critical
CVE-2026-25053
n8n has OS Command Injection in Git Node
Critical
CVE-2026-25052
n8n's Improper File Access Controls Allow Arbitrary File Read by Authenticated Users
High
CVE-2026-25051
n8n's Improper CSP Enforcement in Webhook Responses May Allow Stored XSS
Critical
CVE-2026-25049
n8n Has Expression Escape Vulnerability Leading to RCE
Critical
CVE-2026-21893
n8n Vulnerable to Command Injection in Community Package Installation
High
CVE-2025-61917
n8n's Unsafe Buffer Allocation Allows In-Process Memory Disclosure in Task Runner
Critical
CVE-2026-1470
n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution
Medium
CVE-2025-68949
n8n: Webhook Node IP Whitelist Bypass via Partial String Matching
Medium
CVE-2026-21894
n8n's Missing Stripe-Signature Verification Allows Unauthenticated Forged Webhooks
Critical
CVE-2026-21858
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
Critical
CVE-2026-21877
n8n Vulnerable to RCE via Arbitrary File Write
High
CVE-2025-68697
Self-hosted n8n has Legacy Code node that enables arbitrary file read/write
Critical
CVE-2025-68668
n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node
High
CVE-2025-61914
n8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe Sandbox
Critical
Exploited in attacks
CVE-2025-68613
n8n Vulnerable to Remote Code Execution via Expression Injection
Critical
CVE-2025-65964
n8n vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook
High
CVE-2025-62726
n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook
High
CVE-2025-71380
n8n: Execute Command Node Allows Authenticated Users to Run Arbitrary Commands on Host
Medium
CVE-2025-58177
Stored XSS in n8n LangChain Chat Trigger Node via initialMessages Parameter
High
CVE-2025-56265
N8N's Chat Trigger component is vulnerable to XSS
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.