VULNERABILITY INTELLIGENCE

CVE-2026-77074

CVSS score6 MEDIUM
EPSS probability0.36%
CISA KEVNot currently listed
Published2026-08-20
Last modified2026-09-01
CVSS vectorCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Description

n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users to inject MVG primitives. Attackers can craft malicious text values to issue blind outbound HTTP requests to arbitrary addresses or access local files.

Weakness classification

  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references