n8n Vulnerabilities

npm AI Agents

AI Threat Alert tracks 229 known vulnerabilities in n8n, 24 rated critical — an AI/ML ai agents in the npm ecosystem. Each CVE includes CVSS severity, EPSS exploit probability, patch status, and CISO-grade analysis.

Data sources

Risk Score

229

Total CVEs

Critical

npm

Ecosystem

Sep 8, 2026

Last CVE

53%

Patch Rate

Avg Time to Patch

206,068 stars 60,893 forks 1,108 issues Last push Sep 27, 2026

View on GitHub

OpenSSF Scorecard 6.7/10

Known Vulnerabilities (229 total, page 10 of 10)

Severity CVE ID Summary CVSS Published

MEDIUM CVE-2025-46343 n8n: stored XSS enables account takeover 5.4 Apr 29, 2025 HIGH CVE-2023-27564 n8n: unauthenticated info disclosure exposes credentials 7.5 May 10, 2023 HIGH CVE-2023-27563 n8n: privilege escalation exposes full workflow admin 8.8 May 10, 2023 MEDIUM CVE-2023-27562 n8n: path traversal allows arbitrary file read 6.5 May 10, 2023

Showing 226–229 of 229

← Previous

Frequently asked questions

What is n8n?

n8n is an AI/ML ai agents tracked by AI Threat Alert for security vulnerabilities in the npm ecosystem.

How many known vulnerabilities does n8n have?

n8n has 229 known CVEs, 24 of them critical, tracked from NVD and GitHub Advisory.

Which ecosystem is n8n distributed in?

n8n is distributed via the npm ecosystem and categorized as ai agents.

Where does the n8n vulnerability data come from?

Vulnerability data is sourced from NVD and GitHub Advisory, enriched with CVSS, EPSS, exploit signals, and patch status for each CVE.

How do I assess the risk of n8n?

Review each CVE below — every entry shows CVSS severity, EPSS exploit probability, exploitation signals, and whether a patched version is available.

Monitor n8n in your stack

Get instant alerts when new vulnerabilities affect n8n. CISO analysis, ATLAS technique mappings, and compliance reports included.

Start Monitoring