バナーによると、リモートホスト上で動作しているn8nのバージョンは 1.0.0 以降で、 2.0.0より前です。そのため、以下の複数の脆弱性の影響を受けます。

- 認証された任意のファイルの読み書き脆弱性

- PyodideベースのPythonコードノードにおける認証済み任意のコマンド実行の脆弱性

スキャナーはこれらの問題のテストを行っておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

According to its banner, the version of n8n running on the remote host is 1.0.0 or later and before 2.0.0. It is, therefore, affected by multiple vulnerabilities:

- An authenticated arbitrary file read and file write vulnerability

- An authenticated arbitrary command execution vulnerability in Pyodide based Python code node

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

根据其横幅，远程主机上运行的n8n版本是 1.0.0 或更高版本，更早于 2.0.0。因此，该应用程序受到多个漏洞的影响：

- 认证的任意文件读写漏洞

- 基于Pyodide的Python代码节点中的一个经过认证的任意命令执行漏洞

请注意，扫描程序并未测试这些问题，而是仅依据应用程序自我报告的版本号进行判断。

根據其橫幅，遠端主機上運行的 n8n 版本為 1.0.0 或更新版本，且更早於 2.0.0。因此，會受到多個弱點影響：

- 經過認證的任意檔案讀寫漏洞

- 基於 Pyodide 的 Python 程式碼節點中，一個經過認證的任意指令執行漏洞

請注意，掃描器程式並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - n8n is an open source workflow automation platform. Prior to version 2.0.0, in self-hosted n8n instances
    where the Code node runs in legacy (non-task-runner) JavaScript execution mode, authenticated users with
    workflow editing access can invoke internal helper functions from within the Code node. This allows a
    workflow editor to perform actions on the n8n host with the same privileges as the n8n process, including:
    reading files from the host filesystem (subject to any file-access restrictions configured on the instance
    and OS/container permissions), and writing files to the host filesystem (subject to the same
    restrictions). This issue has been patched in version 2.0.0. Workarounds for this issue involve limiting
    file operations by setting N8N_RESTRICT_FILE_ACCESS_TO to a dedicated directory (e.g., ~/.n8n-files) and
    ensure it contains no sensitive data, keeping N8N_BLOCK_FILE_ACCESS_TO_N8N_FILES=true (default) to block
    access to .n8n and user-defined config files, and disabling high-risk nodes (including the Code node)
    using NODES_EXCLUDE if workflow editors are not fully trusted. (CVE-2025-68697)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
115103	N8n < 2.0.0 複数の脆弱性	Web App Scanning	Artificial Intelligence	2026/1/8	2026/1/8	critical
115103	N8n < 2.0.0 Multiple Vulnerabilities	Web App Scanning	Artificial Intelligence	2026/1/8	2026/1/8	critical
115103	N8n < 2.0.0 多重漏洞	Web App Scanning	Artificial Intelligence	2026/1/8	2026/1/8	critical
115103	N8n < 2.0.0 多重漏洞	Web App Scanning	Artificial Intelligence	2026/1/8	2026/1/8	critical
436491	SCA: security update for n8n (GHSA-j4p8-h8mh-rh8q)	Tenable Self-Hosted Container Security	SCA Checks	2025/12/26	2026/7/6	medium
436491	SCA: security update for n8n (GHSA-j4p8-h8mh-rh8q)	Tenable Cloud Security	SCA Checks	2025/12/26	2026/7/6	medium

检测

插件搜索

critical

critical

critical

critical

medium

medium