| Package | Affected versions | Patched versions |
|---|---|---|
| n8n | = 2.34.0≥ 2.33.0, < 2.33.4 | 2.33.4 |
n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability in the @n8n/workflow-sdk node-schema loader used for MCP node-schema loading. The loader derives a node's schema module path directly from the attacker-supplied node type string without validating path-traversal sequences. An authenticated user with global:member privileges can reference malicious files via path traversal, causing code execution in the n8n main process.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free