漏洞公告

n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`

n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview

n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution

n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool

Duplicate Advisory: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview

Duplicate Advisory: Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware

Duplicate Advisory: Google Service Account Private Key Exposed in JWT Header

Duplicate Advisory: Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass

Duplicate Advisory: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution

Duplicate Advisory: Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion

Duplicate Advisory: n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs

Duplicate Advisory: AI Agents Project Viewer Privilege Escalation via run_node_tool

Duplicate Advisory: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner

Duplicate Advisory: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution

Duplicate Advisory: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook

Duplicate Advisory: Stored DOM XSS via Resource Locator `cachedResultUrl`

Duplicate Advisory: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data

Duplicate Advisory: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction

Duplicate Advisory: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check

Duplicate Advisory: computer-use Shell Sandbox Not Enforced on Linux and Windows

Duplicate Advisory: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives

fast-uri vulnerable to host confusion via literal backslash authority delimiter