Dependency on vulnerable third-party component in n8n - CVE-2026-126384
Published: November 9, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU163075
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126384
CWE-ID: CWE-1395
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker with low privileges to execute arbitrary code on an n8n instance.
The vulnerability exists due to known vulnerabilities in GraphicsMagick components bundled in the official n8n Docker image when the Edit Image node processes untrusted images. A remote authenticated attacker with low privileges can submit a malicious image for processing by that node to trigger code execution.
Affected software
n8n
How to mitigate CVE-2026-126384
Install security update from vendor's website.
n8n - addressed in versions 1.123.89, 2.45.5, 2.46.1, 3.0.1