UpHeron
All vulnerabilities

Servers and applications

CVE-2026-126384

n8n before 1.123.89 RCE via Bundled GraphicsMagick in Edit Image Node

Severity
High 7.7
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
1.123.89, 2.45.5, 2.46.1, 3.0.1
Weakness
CWE-1395
Attack
Over the network · Only under certain conditions · Needs a user account · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Sources
CVE Program

Description

n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 bundles a GraphicsMagick version with known vulnerabilities in its official Docker image, which the Edit Image node uses to process images. Attackers who can supply crafted untrusted images to an Edit Image workflow, such as one fed by a Webhook node, can execute code on the n8n instance.

From the CVE Program.

Affected software

SoftwareAffected versions
n8nServers and applications · cna:n8n-io|n8n
  • Every version before 1.123.89
  • From 2.0.0 before 2.45.5
  • From 2.46.0 before 2.46.1
  • From 3.0.0 before 3.0.1

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126384