| Package | Affected versions | Patched versions |
|---|---|---|
| n8n | = 2.32.0≥ 2.0.0, < 2.31.5< 1.123.67 | 2.31.51.123.67 |
| n8n | ≥ 2.0.0-rc.0, < 2.31.5≥ 2.32.0, < 2.32.1< 1.123.67 | 2.31.52.32.11.123.67 |
The n8n Send Email node did not enforce that its message fields were strings, so a crafted untrusted non-string value from a workflow expression could be treated by the underlying mail library as a file path or URL. This could allow disclosure of local files on the n8n host.
Exploitation requires a pre-existing active workflow with an unauthenticated webhook, valid SMTP credentials configured on the Send Email node, and untrusted input mapped directly into the text or HTML body field. This is not a default n8n configuration.
The issue has been fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free