CVE-2026-77074CWE-94code-injection

CVE-2026-77074

Medium · published August 20, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
28.7
In the wild
Unconfirmed
What it is

n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users to inject MVG primitives. Attackers can craft malicious text values to issue blind outbound HTTP requests to arbitrary addresses or access local files.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
6.0 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00361 · 28.7th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-20T16:16Z
Affected products (3)
ProductVersionsFixed in
n8n/n8n< 1.123.691.123.69
n8n/n8n≥ 2.33.0, < 2.33.42.33.4
n8n/n8nall versions—
References (2)
https://github.com/n8n-io/n8n/security/advisories/GHSA-233r-fpgw-fx8x · [email protected]https://www.vulncheck.com/advisories/n8n-before-ssrf-via-edit-image-node · [email protected]
EPSS history
Timeline
  • 20 AUG 11:21Z
    n8n before 1.123.69 SSRF via Edit Image Node
    cvelistv5