Executive brief
n8n is a workflow automation platform that includes image editing capabilities. The Edit Image node's Draw Text operation contains a vulnerability that allows authenticated users to inject malicious commands into text fields. An attacker could exploit this to make the n8n server issue unauthorized outbound requests to arbitrary servers or access local files on the n8n host.
Technical details
The vulnerability is a code injection flaw (CWE-94) in the Edit Image node's Draw Text operation. A crafted text value can terminate the intended MVG (Magick Vector Graphics) primitive and inject a new primitive, enabling blind SSRF attacks. The attack requires authentication and the ability to create or modify workflows, but does not require user interaction. An authenticated attacker can issue blind HTTP requests to arbitrary addresses or read local files accessible to the n8n process. The vulnerability has been patched in versions 1.123.69, 2.33.4, and 2.34.1.
Affected products
- n8n n8n before 1.123.69, before 2.33.4, before 2.34.1
Timeline
- 2026-08-05: disclosed: GitHub Security Advisory GHSA-233r-fpgw-fx8x published
- 2026-08-20: advisory: CVE-2026-77074 published on NVD
- 2026-08-05: patched: Fixed in versions 1.123.69, 2.33.4, 2.34.1