GHSA-2x35-3fw4-9jr4

Suggest an improvement
Source
https://github.com/advisories/GHSA-2x35-3fw4-9jr4
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2x35-3fw4-9jr4/GHSA-2x35-3fw4-9jr4.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-2x35-3fw4-9jr4
Aliases
Downstream
Published
2026-07-22T22:09:11Z
Modified
2026-08-12T04:26:14Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N CVSS Calculator
Summary
n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion
Details

Impact

The n8n Send Email node did not enforce that its message fields were strings, so a crafted untrusted non-string value from a workflow expression could be treated by the underlying mail library as a file path or URL. This could allow disclosure of local files on the n8n host.

Exploitation requires a pre-existing active workflow with an unauthenticated webhook, valid SMTP credentials configured on the Send Email node, and untrusted input mapped directly into the text or HTML body field. This is not a default n8n configuration.

Patches

The issue has been fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

  • Audit active workflows for Send Email nodes that map untrusted webhook or external data directly into the text or HTML body fields, and remove or restrict those workflows.
  • Restrict public webhook access at the network or reverse-proxy level to prevent unauthenticated callers from reaching sensitive workflows.
  • Restrict workflow creation and editing permissions to fully trusted users only.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Database specific 
{
    "cwe_ids":  [
        "CWE-200",
        "CWE-843",
        "CWE-918"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-22T22:09:11Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

npm / n8n

Package

Name
n8n
View open source insights on deps.dev
Purl
pkg:npm/n8n

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.123.67

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2x35-3fw4-9jr4/GHSA-2x35-3fw4-9jr4.json"

npm / n8n

Package

Name
n8n
View open source insights on deps.dev
Purl
pkg:npm/n8n

Affected ranges

Type
SEMVER
Events
Introduced
2.32.0
Fixed
2.32.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2x35-3fw4-9jr4/GHSA-2x35-3fw4-9jr4.json"

npm / n8n

Package

Name
n8n
View open source insights on deps.dev
Purl
pkg:npm/n8n

Affected ranges

Type
SEMVER
Events
Introduced
2.0.0-rc.0
Fixed
2.31.5

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2x35-3fw4-9jr4/GHSA-2x35-3fw4-9jr4.json"