2.5 KiB
n8n — triage (pin n8nio/n8n:2.42.1, single image, SQLite)
Template: setup_gate: true (owner setup); public behind n8n's own login after that; webhook URLs public by design.
NODES_EXCLUDE NOT set in our compose -> n8n 2.x default applies: packages/@n8n/config nodes.config.ts @ n8n@2.42.1
exclude = ['n8n-nodes-base.executeCommand', 'n8n-nodes-base.localFileTrigger'].
Notices (13 GHSA, no release hits)
- GHSA-365g-vjw2-grx8 (high, "> 0.0.1", no fix): NOT-A-FINDING on our template — Execute Command node is excluded by default
in 2.x and our compose keeps the default; the advisory's own mitigation is exactly that NODES_EXCLUDE. (Becomes real only
if someone sets NODES_EXCLUDE=[] .) Optional hardening: pin
NODES_EXCLUDEexplicitly in the compose so a future default change cannot reopen it. - REAL (12), all need a logged-in member who can create/run workflows (or view executions); multi-user boxes only matter for the credential-isolation ones:
- high: GHSA-m7gv-mpg5-7c9v (glob ReDoS blocks n8n), GHSA-mp7q-23hg-35cf (stored XSS via webhook response — victim opens a public webhook URL), GHSA-wvjj-qg37-pv73 (Data Tables of other projects)
- medium: GHSA-43v8 (Chat Hub chat-user tools), -mgpr (Outlook/SharePoint OData injection, workflow-dependent), -8vrr, -v9cx, -8crx (credential checks bypass), -qmvv, -crfj (secrets in execution error data), -pcr3 (error-workflow identity; fixed 2.42.2), -65mv (Quick Base filter injection, workflow-dependent). Real 12 / 13. Worst: high, login = any workflow-capable member, reachable yes (behind n8n login).
Fix
Smallest fixing all real: 2.43.5 (pcr3 >= 2.42.2; rest >= 2.43.5 / 2.44.1; 2.42.x line has no fix for the rest).
TARGET n8nio/n8n:2.44.7 — newest STABLE 2.x: GitHub stable tag = n8n@2.44.7 (2026-10-26); beta = n8n@2.45.4, so 2.45.x is excluded. Hub tag 2.44.7 exists. Same main (2): yes.
Breaking/migrations 2.42.1 -> 2.44.7 (read 23 release bodies n8n@2.42.2..2.44.7; 2.43.0 and 2.44.0 truncated at 12000 chars, so also read packages/cli/BREAKING-CHANGES.md @ n8n@2.44.7: no entry between 2.0.0 and 2.44.7):
- none found. Note: 2.42.6/2.43.3 "Block create/update of workflows with deprecated nodes" — existing workflows run; editing one that uses a deprecated node is refused (behaviour change, not data). Lane: SECURITY_FIX. (GHSA-365g is NOT_A_FINDING, not NO_FIX.) Classifier note: GHSA-365g ("> 0.0.1", no fix) should be suppressed for n8n >= 2.0 when the compose does not override NODES_EXCLUDE — the node is off by default.