VEXn8n
n8n
11 statements, issued .Each one is a scanner finding that is not exploitable in this image, and why.
@id https://quench-works.com/vex/n8n/2026-11-01
CVE-2026-102826
not affected · vulnerable code not in execute path- simple-git 3.36.0
Measured 2026-10-12 on n8n 2.40.7 (published sha256:cfb73b45). GHSA-g4wm-2vf7-vfgr: the blockUnsafeOperationsPlugin denylist misses include.path / includeIf, so a -c include.path=<file> argument reaches git, and git then loads that file and runs a command it names. The command runs only inside a git process, and this image ships no git executable: apko.yaml installs only wolfi-baselayout, ca-certificates-bundle, tzdata, nodejs-24 and quench-n8n; the full image file list (crane export, 263k entries) has no file named git and only ldconfig and node in /usr/bin; no shell either. Verified inside the image: simpleGit with config include.path plus a push carrying --receive-p rejects with spawn git ENOENT, and simpleGit().version() returns installed=false. n8n source control also refuses to start without git (cli dist/modules/source-control.ee/source-control-git.service.ee.js:74 Git binary not found). test.sh fails the build if any executable named git appears, so this statement cannot outlive its precondition.
CVE-2026-102827
not affected · vulnerable code not in execute path- simple-git 3.36.0
Measured 2026-10-12 on n8n 2.40.7 (published sha256:cfb73b45). GHSA-858h-whjf-mvg5: git accepts abbreviated long options (--receive-p, --exe) that the denylist does not match, so git push runs the named command. The command runs only inside a git process, and this image ships no git executable: apko.yaml installs only wolfi-baselayout, ca-certificates-bundle, tzdata, nodejs-24 and quench-n8n; the image file list (crane export) has no file named git and only ldconfig and node in /usr/bin. Verified inside the image: git.push with --receive-p=touch /tmp/pwn rejects with spawn git ENOENT and no file is created; simpleGit().version() returns installed=false. The n8n Git node also rejects push targets starting with a hyphen (n8n-nodes-base 2.40.2 dist/nodes/Git/Git.node.js:311). test.sh fails the build if any executable named git appears.
CVE-2026-102828
not affected · vulnerable code not in execute path- simple-git 3.36.0
Measured 2026-10-12 on n8n 2.40.7 (published sha256:cfb73b45). GHSA-x6jw-m9v5-85vh: trailer.<token>.cmd is not on the denylist, so git interpret-trailers runs the configured command. That needs a git process, and this image ships no git executable: apko.yaml installs only wolfi-baselayout, ca-certificates-bundle, tzdata, nodejs-24 and quench-n8n; the image file list (crane export) has no file named git and only ldconfig and node in /usr/bin. Verified inside the image: simple-git calls reject with spawn git ENOENT and simpleGit().version() returns installed=false. n8n never runs interpret-trailers or commit --trailer (grep over the n8n 2.40.7 and n8n-nodes-base 2.40.2 dist: 0 matches), and the Git node addConfig allows only user.email, user.name, remote.origin.url by default (dist/nodes/Git/descriptions/AddConfigDescription.js:4). test.sh fails the build if any executable named git appears.
CVE-2026-102829
not affected · vulnerable code not in execute path- argv-parser 1.1.1
Measured 2026-10-12 on n8n 2.40.7 (published sha256:cfb73b45). GHSA-v5rq-49vh-5v5c: parseEnv drops VISUAL, so an attacker-set VISUAL editor is not flagged and git launches it during an interactive operation. That needs a git process, and this image ships no git executable: apko.yaml installs only wolfi-baselayout, ca-certificates-bundle, tzdata, nodejs-24 and quench-n8n; the image file list (crane export) has no file named git and only ldconfig and node in /usr/bin. Verified inside the image: simpleGit().env({VISUAL}) followed by a push rejects with spawn git ENOENT; simpleGit().version() returns installed=false. n8n also never forwards caller env to git: the Git node passes a fresh object holding only GIT_TERMINAL_PROMPT and GIT_ALLOW_PROTOCOL (n8n-nodes-base 2.40.2 dist/nodes/Git/Git.node.js:490). test.sh fails the build if any executable named git appears.
CVE-2026-109461
not affected · vulnerable code not in execute path- msal-node 5.1.5
The advisory (GHSA for @azure/msal-node >=5.0.0-beta.0 <7.1.0): an origin validation error in the authorization code flow can disclose parameters passed to acquireTokenByCode to an attacker-controlled endpoint; the stated workaround is to pass only the auth code to acquireTokenByCode. In n8n 2.40.7 this 5.1.5 copy is nested under node_modules/@microsoft/agents-hosting (1.6.1, pulled by @n8n/n8n-nodes-langchain 2.40.3), so only agents-hosting can load it. Its single importer is dist/src/auth/msalTokenProvider.js (require at line 11), which uses only acquireTokenByClientCredential (:228), acquireTokenOnBehalfOf (:201) and its certificate, managed-identity and agentic wrappers (:118-336). Verified 2026-11-01 on the npm tarball agents-hosting-1.6.1.tgz: grep -rlE 'acquireTokenByCode|getAuthCodeUrl|AuthorizationCodeRequest' over the package returned no file. The other msal-node copies in the image move to 7.1.0 through @azure/identity 4.14.1. No agents-hosting release moves past msal-node 5.6.0 (1.9.1, 2026-11-01).
CVE-2026-115905
not affected · vulnerable code not in execute path- zip 8.2.0
The advisory: ZipStreamReader (src/read/stream.rs) extracts by Local File Header names while ZipArchive trusts the Central Directory; exploitation needs the streaming reader, which agent-browser never uses. zip 8.2.0 is linked only into the prebuilt agent-browser binaries (opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64 and -arm64, agent-browser 0.26.0, pulled by @n8n/mcp-browser). In the v0.26.0 source (tag 717d1b09e1c841a4c0206033886a1a861e3ca5d9) cli/Cargo.toml:31 declares zip 8.2.0 with default-features = false and features = ["deflate"], and cli/Cargo.lock lists agent-browser as its only dependent, so no other crate turns on more features. The crate is used only by extract_zip in cli/src/install.rs:334-380 (the `agent-browser install` Chrome download): zip::ZipArchive::new over an in-memory cursor (:340), then by_index (:344) with enclosed_name() and its own starts_with(dest) containment check. Verified 2026-11-01: grep -rnE 'zip::|ZipArchive|ZipWriter|\.extract\(|by_index|by_name' cli/src returns only install.rs:340 and :344, and grep for ZipStreamReader|read_zipfile_from_stream|extract_unwrapped returns nothing. Even agent-browser 0.41.0 (newest, 2026-10-29) still locks zip 8.2.0.
CVE-2026-115906
not affected · vulnerable code not present- zip 8.2.0
The advisory: the AES entry reader (src/aes.rs) skips its HMAC check on premature EOF. That reader exists only with the aes-crypto feature, which this copy does not enable, so the AES code is not compiled in. zip 8.2.0 is linked only into the prebuilt agent-browser binaries (opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64 and -arm64, agent-browser 0.26.0, pulled by @n8n/mcp-browser). In the v0.26.0 source (tag 717d1b09e1c841a4c0206033886a1a861e3ca5d9) cli/Cargo.toml:31 declares zip 8.2.0 with default-features = false and features = ["deflate"], and cli/Cargo.lock lists agent-browser as its only dependent, so no other crate turns on more features. The crate is used only by extract_zip in cli/src/install.rs:334-380 (the `agent-browser install` Chrome download): zip::ZipArchive::new over an in-memory cursor (:340), then by_index (:344) with enclosed_name() and its own starts_with(dest) containment check. Verified 2026-11-01: grep -rnE 'zip::|ZipArchive|ZipWriter|\.extract\(|by_index|by_name' cli/src returns only install.rs:340 and :344, and grep for ZipStreamReader|read_zipfile_from_stream|extract_unwrapped returns nothing. Even agent-browser 0.41.0 (newest, 2026-10-29) still locks zip 8.2.0.
CVE-2026-115907
not affected · vulnerable code not present- zip 8.2.0
The advisory: the Shrink/Reduce/Implode decoders of the legacy-zip feature preallocate from an attacker-controlled size. legacy-zip is not enabled on this copy, so those decoders are not compiled in. zip 8.2.0 is linked only into the prebuilt agent-browser binaries (opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64 and -arm64, agent-browser 0.26.0, pulled by @n8n/mcp-browser). In the v0.26.0 source (tag 717d1b09e1c841a4c0206033886a1a861e3ca5d9) cli/Cargo.toml:31 declares zip 8.2.0 with default-features = false and features = ["deflate"], and cli/Cargo.lock lists agent-browser as its only dependent, so no other crate turns on more features. The crate is used only by extract_zip in cli/src/install.rs:334-380 (the `agent-browser install` Chrome download): zip::ZipArchive::new over an in-memory cursor (:340), then by_index (:344) with enclosed_name() and its own starts_with(dest) containment check. Verified 2026-11-01: grep -rnE 'zip::|ZipArchive|ZipWriter|\.extract\(|by_index|by_name' cli/src returns only install.rs:340 and :344, and grep for ZipStreamReader|read_zipfile_from_stream|extract_unwrapped returns nothing. Even agent-browser 0.41.0 (newest, 2026-10-29) still locks zip 8.2.0.
CVE-2026-115908
not affected · vulnerable code not in execute path- zip 8.2.0
The advisory: ZipArchive::extract and extract_unwrapped_root_dir validate symlink targets lexically and can write outside the extraction directory. Neither is called; agent-browser writes each entry itself after enclosed_name() and a containment check. zip 8.2.0 is linked only into the prebuilt agent-browser binaries (opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64 and -arm64, agent-browser 0.26.0, pulled by @n8n/mcp-browser). In the v0.26.0 source (tag 717d1b09e1c841a4c0206033886a1a861e3ca5d9) cli/Cargo.toml:31 declares zip 8.2.0 with default-features = false and features = ["deflate"], and cli/Cargo.lock lists agent-browser as its only dependent, so no other crate turns on more features. The crate is used only by extract_zip in cli/src/install.rs:334-380 (the `agent-browser install` Chrome download): zip::ZipArchive::new over an in-memory cursor (:340), then by_index (:344) with enclosed_name() and its own starts_with(dest) containment check. Verified 2026-11-01: grep -rnE 'zip::|ZipArchive|ZipWriter|\.extract\(|by_index|by_name' cli/src returns only install.rs:340 and :344, and grep for ZipStreamReader|read_zipfile_from_stream|extract_unwrapped returns nothing. Even agent-browser 0.41.0 (newest, 2026-10-29) still locks zip 8.2.0.
CVE-2026-115909
not affected · vulnerable code not in execute path- zip 8.2.0
The advisory: ZipArchive::extract preallocates a symlink target from an attacker-controlled ZIP64 size. ZipArchive::extract is never called. zip 8.2.0 is linked only into the prebuilt agent-browser binaries (opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64 and -arm64, agent-browser 0.26.0, pulled by @n8n/mcp-browser). In the v0.26.0 source (tag 717d1b09e1c841a4c0206033886a1a861e3ca5d9) cli/Cargo.toml:31 declares zip 8.2.0 with default-features = false and features = ["deflate"], and cli/Cargo.lock lists agent-browser as its only dependent, so no other crate turns on more features. The crate is used only by extract_zip in cli/src/install.rs:334-380 (the `agent-browser install` Chrome download): zip::ZipArchive::new over an in-memory cursor (:340), then by_index (:344) with enclosed_name() and its own starts_with(dest) containment check. Verified 2026-11-01: grep -rnE 'zip::|ZipArchive|ZipWriter|\.extract\(|by_index|by_name' cli/src returns only install.rs:340 and :344, and grep for ZipStreamReader|read_zipfile_from_stream|extract_unwrapped returns nothing. Even agent-browser 0.41.0 (newest, 2026-10-29) still locks zip 8.2.0.
CVE-2026-118764
not affected · vulnerable code not present- minimatch 3.1.5
The advisory: minimatch before 11.0.1 expands attacker-controlled **/.. segments in firstPhasePreProcess() and compares them pairwise in secondPhasePreProcess(), run at optimizationLevel 2 or higher. Those functions and the optimizationLevel option arrived with the minimatch 7+ rewrite; 3.1.5 is the old single-file implementation. Verified 2026-11-01 on the npm tarball minimatch-3.1.5.tgz: grep -c 'firstPhasePreProcess\|optimizationLevel' package/minimatch.js returned 0. The minimatch 10 copies are overridden to 11.0.1 instead (melange.yaml).