{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-46343", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-04-22T22:41:54.912Z", "datePublished": "2025-04-29T04:35:16.684Z", "dateUpdated": "2025-04-29T13:35:04.707Z"}, "containers": {"cna": {"title": "n8n Vulnerable to Stored XSS through Attachments View Endpoint", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/n8n-io/n8n/security/advisories/GHSA-c8hm-hr8h-5xjw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-c8hm-hr8h-5xjw"}, {"name": "https://github.com/n8n-io/n8n/pull/14350", "tags": ["x_refsource_MISC"], "url": "https://github.com/n8n-io/n8n/pull/14350"}, {"name": "https://github.com/n8n-io/n8n/pull/14685", "tags": ["x_refsource_MISC"], "url": "https://github.com/n8n-io/n8n/pull/14685"}, {"name": "https://github.com/n8n-io/n8n/releases/tag/n8n%401.90.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/n8n-io/n8n/releases/tag/n8n%401.90.0"}], "affected": [{"vendor": "n8n-io", "product": "n8n", "versions": [{"version": "< 1.90.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-04-29T04:35:16.684Z"}, "descriptions": [{"lang": "en", "value": "n8n is a workflow automation platform. Prior to version 1.90.0, n8n is vulnerable to stored cross-site scripting (XSS) through the attachments view endpoint. n8n workflows can store and serve binary files, which are accessible to authenticated users. However, there is no restriction on the MIME type of uploaded files, and the MIME type could be controlled via a GET parameter. This allows the server to respond with any MIME type, potentially enabling malicious content to be interpreted and executed by the browser. An authenticated attacker with member-level permissions could exploit this by uploading a crafted HTML file containing malicious JavaScript. When another user visits the binary data endpoint with the MIME type set to text/html, the script executes in the context of the user\u2019s session. This script could send a request to change the user\u2019s email address in their account settings, effectively enabling account takeover. This issue has been patched in version 1.90.0."}], "source": {"advisory": "GHSA-c8hm-hr8h-5xjw", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-29T13:34:53.606717Z", "id": "CVE-2025-46343", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-29T13:35:04.707Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-46343", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-29T13:34:53.606717Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-29T13:34:59.107Z"}}], "cna": {"title": "n8n Vulnerable to Stored XSS through Attachments View Endpoint", "source": {"advisory": "GHSA-c8hm-hr8h-5xjw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": "< 1.90.0"}]}], "references": [{"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-c8hm-hr8h-5xjw", "name": "https://github.com/n8n-io/n8n/security/advisories/GHSA-c8hm-hr8h-5xjw", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/n8n-io/n8n/pull/14350", "name": "https://github.com/n8n-io/n8n/pull/14350", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/n8n-io/n8n/pull/14685", "name": "https://github.com/n8n-io/n8n/pull/14685", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/n8n-io/n8n/releases/tag/n8n%401.90.0", "name": "https://github.com/n8n-io/n8n/releases/tag/n8n%401.90.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "n8n is a workflow automation platform. Prior to version 1.90.0, n8n is vulnerable to stored cross-site scripting (XSS) through the attachments view endpoint. n8n workflows can store and serve binary files, which are accessible to authenticated users. However, there is no restriction on the MIME type of uploaded files, and the MIME type could be controlled via a GET parameter. This allows the server to respond with any MIME type, potentially enabling malicious content to be interpreted and executed by the browser. An authenticated attacker with member-level permissions could exploit this by uploading a crafted HTML file containing malicious JavaScript. When another user visits the binary data endpoint with the MIME type set to text/html, the script executes in the context of the user\u2019s session. This script could send a request to change the user\u2019s email address in their account settings, effectively enabling account takeover. This issue has been patched in version 1.90.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-04-29T04:35:16.684Z"}}}, "cveMetadata": {"cveId": "CVE-2025-46343", "state": "PUBLISHED", "dateUpdated": "2025-04-29T13:35:04.707Z", "dateReserved": "2025-04-22T22:41:54.912Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-04-29T04:35:16.684Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "CEB21246-43EC-4C76-89AD-D0B3CE75CE64", "versionEndExcluding": "1.90.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "n8n is a workflow automation platform. Prior to version 1.90.0, n8n is vulnerable to stored cross-site scripting (XSS) through the attachments view endpoint. n8n workflows can store and serve binary files, which are accessible to authenticated users. However, there is no restriction on the MIME type of uploaded files, and the MIME type could be controlled via a GET parameter. This allows the server to respond with any MIME type, potentially enabling malicious content to be interpreted and executed by the browser. An authenticated attacker with member-level permissions could exploit this by uploading a crafted HTML file containing malicious JavaScript. When another user visits the binary data endpoint with the MIME type set to text/html, the script executes in the context of the user\u2019s session. This script could send a request to change the user\u2019s email address in their account settings, effectively enabling account takeover. This issue has been patched in version 1.90.0."}, {"lang": "es", "value": "n8n es una plataforma de automatizaci\u00f3n de flujos de trabajo. Antes de la versi\u00f3n 1.90.0, n8n era vulnerable a ataques de Cross-Site Scripting (XSS) almacenado a trav\u00e9s del endpoint de vista de adjuntos. Los flujos de trabajo de n8n pueden almacenar y servir archivos binarios, accesibles para usuarios autenticados. Sin embargo, no hay restricci\u00f3n en el tipo MIME de los archivos subidos, y este se puede controlar mediante un par\u00e1metro GET. Esto permite al servidor responder con cualquier tipo MIME, lo que podr\u00eda permitir que el navegador interprete y ejecute contenido malicioso. Un atacante autenticado con permisos de miembro podr\u00eda explotar esto subiendo un archivo HTML manipulado con JavaScript malicioso. Cuando otro usuario visita el endpoint de datos binarios con el tipo MIME establecido en text/html, el script se ejecuta en el contexto de la sesi\u00f3n del usuario. Este script podr\u00eda enviar una solicitud para cambiar la direcci\u00f3n de correo electr\u00f3nico del usuario en la configuraci\u00f3n de su cuenta, lo que permite el robo de la cuenta. Este problema se ha corregido en la versi\u00f3n 1.90.0."}], "id": "CVE-2025-46343", "lastModified": "2025-05-09T19:37:16.010", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 4.2, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "[email protected]", "type": "Primary"}]}, "published": "2025-04-29T05:15:47.157", "references": [{"source": "[email protected]", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/n8n-io/n8n/pull/14350"}, {"source": "[email protected]", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/n8n-io/n8n/pull/14685"}, {"source": "[email protected]", "tags": ["Release Notes"], "url": "https://github.com/n8n-io/n8n/releases/tag/n8n%401.90.0"}, {"source": "[email protected]", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-c8hm-hr8h-5xjw"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "[email protected]", "type": "Primary"}]}

{}