Vulnerabilidades em n8n-io

97 resultados
Análise Vexday

O ecossistema n8n-io acumula 79 CVEs catalogadas, com 23 classificadas como críticas e um volume expressivo de 33 vulnerabilidades surgidas apenas nos últimos 90 dias, sinalizando uma superfície de ataque em expansão acelerada. A taxa de exploração ativa está 2,8× acima da média geral do catálogo CISA KEV, o que indica que, apesar do número absoluto pequeno, as falhas presentes nesse produto atraem atenção real de atores maliciosos de forma desproporcional. O destaque de maior risco é CVE-2025-68613, com score EPSS de 0,9788 — próximo ao teto máximo de probabilidade de exploração —, confirmada em exploração ativa e exigindo atenção imediata de equipes de resposta. O tipo de falha mais prevalente é CWE-79 (Cross-Site Scripting), uma classe de vulnerabilidade que, em plataformas de automação com integrações externas como o n8n, pode ter impacto amplificado por viabilizar comprometimento de fluxos e credenciais encadeadas.

CVE-2025-68613CRITICALn8n Vulnerable to Remote Code Execution via Expression InjectionEPSS 97.9%KEVCVE-2026-21858CRITICALn8n Vulnerable to Unauthenticated File Access via Improper Webhook Request HandlingEPSS 71.6%CVE-2025-68668CRITICALn8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code NodeEPSS 12.9%CVE-2026-27577CRITICALn8n: Expression Sandbox Escape Leads to RCEEPSS 8.6%CVE-2026-21877CRITICALn8n is vulnerable to Remote Code Execution via Arbitrary File WriteEPSS 5.3%CVE-2026-25055HIGHn8n Arbitrary File Write on Remote Systems via SSH NodeEPSS 1.7%CVE-2026-21893CRITICALn8n Vulnerable to Command Injection in Community Package InstallationEPSS 1.3%CVE-2026-25049CRITICALn8n Has an Expression Escape Vulnerability Leading to RCEEPSS 1.2%CVE-2026-27493CRITICALn8n has Unauthenticated Expression Evaluation via Form NodeEPSS 1.1%CVE-2026-33660CRITICALn8n Has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL ModeEPSS 1.0%CVE-2026-44789CRITICALn8n: HTTP Request Node Pagination Prototype Pollution to RCEEPSS 0.9%CVE-2026-42231CRITICALn8n: Prototype Pollution in XML Webhook Body Parser Leads to RCEEPSS 0.9%CVE-2026-33696CRITICALn8n Vulnerable to Prototype Pollution in XML & GSuiteAdmin node parameters lead to RCEEPSS 0.8%CVE-2026-27497CRITICALn8n has Potential Remote Code Execution via Merge NodeEPSS 0.8%CVE-2025-62726HIGHn8n Vulnerable to Remote Code Execution via Git Node Pre-Commit HookEPSS 0.8%CVE-2026-27495CRITICALn8n has a Sandbox Escape in its JavaScript Task RunnerEPSS 0.7%CVE-2026-27498CRITICALn8n has Arbitrary Command Execution via File Write and Git OperationsEPSS 0.7%CVE-2025-65964CRITICALn8n Vulnerable to Remote Code Execution via Git Node Custom Pre-Commit HookEPSS 0.7%CVE-2026-25056CRITICALn8n Arbitrary File Write leading to RCE in n8n Merge NodeEPSS 0.7%CVE-2026-44790CRITICALn8n: Arbitrary File Read via Git NodeEPSS 0.6%