n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property f…
Medium CVSS 6.4
Summary
n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present, allowing attackers to bypass validation by supplying a safe uri alongside a malicious url to access internal addresses.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://github.com/n8n-io/n8n/security/advisories/GHSA-jp9j-jr97-w9pj Mitigation
- https://www.vulncheck.com/advisories/n8n-before-2.34.1-ssrf-via-request-helper-uri-validation-bypass Third Party Advisory
Timeline
- nvd_ingest NVD