How many CVEs have a located fix in n8n-io/n8n?

31 published CVEs have a fix traced to functions in n8n-io/n8n, touching 130 functions across 86 files.

Which function in n8n-io/n8n has been patched by the most CVEs?

createPage in packages/@n8n/nodes-langchain/nodes/trigger/ChatTrigger/templates.ts has been changed by 4 CVE fixes, from 2025 to 2026.

How large is a typical CVE fix in n8n-io/n8n?

The median fix changes 58 lines. 26% of fixes change 20 lines or fewer, and 23% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

typescript

python

#148 of 500 repositories

n8n-io/n8n

Name: n8n-io/n8n: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix September 8, 2026

31

CVE fixes located

Published CVEs

130

Functions patched

Distinct function sites

86

Files patched

Distinct source files

2023–2026

Years covered

By CVE publication date

Overview

31 published CVEs have a fix traced to functions in n8n-io/n8n, the earliest published in 2023. Those fixes changed 130 distinct functions across 86 files, in 939 patch hunks.

Among the 500 repositories tracked here, n8n-io/n8n ranks #148 by the number of CVEs with a located fix.

Most patched functions

Functions in n8n-io/n8n changed by the most CVE fixes.

Most patched files

Files in n8n-io/n8n changed by the most CVE fixes.

1packages/workflow/src/expression-sandboxing.ts5 CVEs · 7 functions
2packages/workflow/src/utils.ts5 CVEs · 2 functions
3packages/@n8n/task-runner-python/src/constants.py5 CVEs · 0 functions
4packages/@n8n/task-runner/src/js-task-runner/js-task-runner.ts4 CVEs · 6 functions
5packages/nodes-base/nodes/Form/utils/utils.ts4 CVEs · 3 functions
6packages/workflow/src/interfaces.ts4 CVEs · 3 functions
7packages/@n8n/nodes-langchain/nodes/trigger/ChatTrigger/templates.ts4 CVEs · 2 functions
8packages/nodes-base/utils/sendAndWait/utils.ts4 CVEs · 2 functions
9packages/nodes-base/nodes/Form/Form.node.ts4 CVEs · 1 functions
10packages/nodes-base/nodes/Git/Git.node.ts4 CVEs · 1 functions

Fix size

How much code a CVE fix in n8n-io/n8n changes, with backports counted once.

58

Median lines changed

Added plus removed, per CVE

26%

Fixes of 20 lines or fewer

Share of CVE fixes

23%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in n8n-io/n8n, and the functions each fix changed.

n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution
CVE-2026-86073AddResourceToOAuthRefreshTokens1787739515257 OAuthServerService OAuthTokenService
Medium · CVSS 5.9
EPSS 0.4%2026-09-08
n8n - SQL Injection in MySQL, PostgreSQL, and Microsoft SQL Nodes
CVE-2026-56351has escapeIdentifier execute
Medium · CVSS 5.3
EPSS 0.4%2026-06-24
n8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Trigger
CVE-2026-56357computes webhook GithubTrigger
Medium · CVSS 6.3
EPSS 0.3%2026-06-22
n8n has Arbitrary Command Execution via File Write and Git Operations
CVE-2026-27498isFilePatternBlocked SecurityConfig isFilePathBlocked
Critical · CVSS 9.0
EPSS 1.4%2026-02-25
n8n Vulnerable to Stored XSS via Various Nodes
CVE-2026-27578WebhookNodeResponseHeaders AstNode visitAssignmentExpression
High · CVSS 8.5
EPSS 0.3%2026-02-25
n8n: Expression Sandbox Escape Leads to RCE
CVE-2026-27577WebhookNodeResponseHeaders AstNode visitAssignmentExpression
Critical · CVSS 9.4
EPSS 1.0%2026-02-25
n8n has Unauthenticated Expression Evaluation via Form Node
CVE-2026-27493WebhookNodeResponseHeaders AstNode visitAssignmentExpression
Critical · CVSS 9.5
EPSS 1.6%2026-02-25
n8n Vulnerable to Command Injection in Community Package Installation
CVE-2026-21893CommunityPackagesController CommunityPackagesService
Critical · CVSS 9.4
EPSS 1.6%2026-02-04
n8n is vulnerable to Python sandbox escape
CVE-2026-25115visit_MatchClass
Critical · CVSS 9.4
EPSS 0.6%2026-02-04
n8n Arbitrary File Write on Remote Systems via SSH Node
CVE-2026-25055sanitizeFilename Ssh copyBinaryFile
High · CVSS 7.1
EPSS 1.9%2026-02-04
n8n Improper CSP Enforcement in Webhook Responses May Allow Stored XSS
CVE-2026-25051
High · CVSS 8.5
EPSS 0.3%2026-02-04
n8n Unsafe Buffer Allocation Allows In-Process Memory Disclosure in Task Runner
CVE-2025-61917get
High · CVSS 7.7
EPSS 0.4%2026-02-04

Get an alert for each new n8n-io/n8n CVE, with the patched functions and AI-written analysis.

Monitor n8n CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

contao/contao31 CVEs pgadmin-org/pgadmin431 CVEs pyload/pyload31 CVEs Samsung/escargot31 CVEs uclouvain/openjpeg31 CVEs wazuh/wazuh31 CVEs debian/gpac32 CVEs debian/w3m32 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in n8n-io/n8n.

How many CVEs have a located fix in n8n-io/n8n?: 31 published CVEs have a fix traced to functions in n8n-io/n8n, touching 130 functions across 86 files.
Which function in n8n-io/n8n has been patched by the most CVEs?: createPage in packages/@n8n/nodes-langchain/nodes/trigger/ChatTrigger/templates.ts has been changed by 4 CVE fixes, from 2025 to 2026.
How large is a typical CVE fix in n8n-io/n8n?: The median fix changes 58 lines. 26% of fixes change 20 lines or fewer, and 23% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track n8n-io/n8n CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing