CyberRota Analysis
AI-Generatedn8n versions prior to 1.123.73, 2.35.4, and 2.36.2 are vulnerable due to insufficient validation of message content in the Gmail and Brevo nodes, allowing authenticated users to exploit this flaw. This can lead to local file disclosure or server-side request forgery (SSRF), potentially exposing sensitive information or internal resources. Organizations using affected n8n versions should prioritize patching to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo nodes to the mail composer without verifying it is a string. An authenticated user able to run a workflow can supply an expression that resolves to an object carrying a path or href property, causing the composer to read a local file accessible to the n8n process or fetch an internal URL (SSRF) and attach the result to the outgoing message.