n8n Vulnerabilities

npm AI Agents

AI Threat Alert tracks 116 known vulnerabilities in n8n, 22 rated critical — an AI/ML ai agents in the npm ecosystem. Each CVE includes CVSS severity, EPSS exploit probability, patch status, and CISO-grade analysis.

Data sources

Risk Score

116

Total CVEs

Critical

npm

Ecosystem

Jun 30, 2026

Last CVE

53%

Patch Rate

Avg Time to Patch

194,300 stars 58,888 forks 1,482 issues Last push Jun 28, 2026

View on GitHub

OpenSSF Scorecard 6.6/10

Known Vulnerabilities (116 total, page 5 of 5)

Severity CVE ID Summary CVSS Published

MEDIUM CVE-2025-61914 n8n: XSS enables session hijacking 5.4 Dec 26, 2025 HIGH CVE-2025-68613 n8n: security flaw enables exploitation 8.8 Dec 19, 2025 HIGH CVE-2025-65964 n8n: security flaw enables exploitation 8.8 Dec 9, 2025 HIGH CVE-2025-62726 n8n: security flaw enables exploitation 8.8 Oct 30, 2025 MEDIUM CVE-2025-58177 n8n: stored XSS in LangChain chat trigger (public) 5.4 Sep 15, 2025 HIGH CVE-2025-56265 n8n: unrestricted file upload RCE via Chat Trigger 8.8 Sep 8, 2025 CRITICAL CVE-2025-55526 n8n-workflows: path traversal in download_workflow endpoint 9.1 Aug 26, 2025 MEDIUM CVE-2025-57749 n8n: symlink traversal enables arbitrary file read/write 6.5 Aug 20, 2025 MEDIUM CVE-2025-52478 n8n: Stored XSS enables full account takeover 5.4 Aug 19, 2025 MEDIUM CVE-2025-52554 n8n: broken authz enables cross-user workflow termination 4.3 Jul 3, 2025 MEDIUM CVE-2025-49595 n8n: DoS via empty filesystem URI in binary-data API 4.9 Jul 3, 2025 MEDIUM CVE-2025-49592 n8n: open redirect enables phishing via login flow 5.4 Jun 26, 2025 MEDIUM CVE-2025-46343 n8n: stored XSS enables account takeover 5.4 Apr 29, 2025 HIGH CVE-2023-27564 n8n: unauthenticated info disclosure exposes credentials 7.5 May 10, 2023 HIGH CVE-2023-27563 n8n: privilege escalation exposes full workflow admin 8.8 May 10, 2023 MEDIUM CVE-2023-27562 n8n: path traversal allows arbitrary file read 6.5 May 10, 2023

Showing 101–116 of 116

← Previous

Frequently asked questions

What is n8n?

n8n is an AI/ML ai agents tracked by AI Threat Alert for security vulnerabilities in the npm ecosystem.

How many known vulnerabilities does n8n have?

n8n has 116 known CVEs, 22 of them critical, tracked from NVD and GitHub Advisory.

Which ecosystem is n8n distributed in?

n8n is distributed via the npm ecosystem and categorized as ai agents.

Where does the n8n vulnerability data come from?

Vulnerability data is sourced from NVD and GitHub Advisory, enriched with CVSS, EPSS, exploit signals, and patch status for each CVE.

How do I assess the risk of n8n?

Review each CVE below — every entry shows CVSS severity, EPSS exploit probability, exploitation signals, and whether a patched version is available.

Monitor n8n in your stack

Get instant alerts when new vulnerabilities affect n8n. CISO analysis, ATLAS technique mappings, and compliance reports included.

Start Monitoring