n8n Gmail/Brevo nodes SSRF & local file read via unvalidated input (GHSA-95ph-833c-4wrp)

Vulnerability Summary: Gmail and Brevo Nodes Accept Non-String Content, Leading to Local File Read and SSRF Vulnerability Overview Vulnerability ID: GHSA-95ph-833c-4wrp Severity: High (CVSS 7.1 / 10) Vulnerability Type: Input Validation Flaw Description: The Gmail (v1) and Brevo nodes pass message content directly to the mail editor without validating that it is a string. When the expression resolves to an object (such as or a property), the editor will read local files or fetch URLs, and attach the result to the outgoing message. Attack Vector: Network Attack Complexity: Low Authentication Requirements: None Privilege Requirements: Low User Interaction: None Confidentiality Impact: High Integrity Impact: High Availability Impact: None Scope of Impact Affected Package: Affected Versions: - - - Fixed Versions: - - - Remediation Patch: This issue has been fixed in n8n versions 1.123.73, 2.35.4, and 2.36.2. Users should upgrade to one of the aforementioned versions or higher to eliminate the vulnerability. Temporary Workarounds If immediate upgrade is not possible, administrators can consider the following temporary mitigation measures: Restrict access to the n8n instance to fully trusted users only. Disable the Gmail node by adding to the environment variable. Ensure the n8n process runs under a dedicated, low-privilege OS user account with minimal permissions to limit file access scope. > Note: These temporary measures do not fully eliminate the risk and serve only as short-term mitigations. POC / Exploit Code No specific POC code or exploit code blocks are included in the screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

n8n Gmail/Brevo nodes SSRF & local file read via unvalidated input (GHSA-95ph-833c-4wrp)

More from this source