CyberRota Analysis
AI-GeneratedVersions of n8n prior to 1.123.69 are susceptible to a server-side request forgery vulnerability in the Edit Image node's Draw Text operation, enabling authenticated users to inject malicious text that can trigger blind outbound HTTP requests or access local files. This vulnerability poses a medium risk as it could lead to unauthorized data exposure or service disruption. Organizations using n8n should prioritize updating to the latest version to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users to inject MVG primitives. Attackers can craft malicious text values to issue blind outbound HTTP requests to arbitrary addresses or access local files.
Related CVEs
Other vulnerabilities affecting the same vendor(s)