CyberRota Analysis
AI-GeneratedThe Send Email node in n8n versions prior to 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 is vulnerable to a type confusion issue, allowing non-string values to be processed as file paths or URLs. This can lead to arbitrary local file disclosure and server-side request forgery (SSRF) if exploited, requiring specific conditions such as an active workflow with an unauthenticated webhook and valid SMTP credentials. Organizations using affected versions of n8n, particularly those with workflows that handle untrusted input, should prioritize patching to mitigate the risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow expression into the text or HTML body field can be interpreted by the underlying mail library (Nodemailer) as a file path or URL, allowing arbitrary local file disclosure and server-side request forgery (SSRF). Exploitation requires a pre-existing active workflow with an unauthenticated webhook, valid SMTP credentials configured on the node, and untrusted input mapped directly into the body field; this is not a default configuration.