n8n 2.45.4 → 2.45.5
1 release · 0 breaking changes · 9 security fixes · 9 advisories fixed
9security0breaking0deprecated1feature8fix
Vulnerabilities fixed by this upgrade
- 6.3 GHSA-jmcg-c7p5-q69g NocoDB Node Sends Its API Token to Attacker-Chosen Hosts When Downloading Attachments
- 6.3 GHSA-prmc-fg87-r4gh Credential-Using Nodes Forward Authentication Headers on Cross-Origin Redirects
- 5.1 GHSA-rc3w-8jc8-7x3w Open Redirect via MCP OAuth Dynamic Client Registration
- 4.8 GHSA-426f-xmcv-g8pg OAuth Account Hijack in the End-User Credential Connect Flow via Unauthenticated Callback
- 5.3 GHSA-4v22-g448-h4rg MongoDB Node Update Operations Can Modify Unintended Documents
- 6.3 GHSA-pwj5-wwm6-g83j Chat Trigger Embedded Chat Does Not Enforce n8n User Auth on All Requests
- 6.0 GHSA-9qx8-fhxv-w794 Browser Use Upload Tool Reads Arbitrary Files from the n8n Server
- 7.7 GHSA-gx3v-3x3v-f8r5 Insufficient Isolation in Workflow Expression Evaluation
- 7.7 GHSA-f2cw-9483-7vcp Insecure GraphicsMagick Configuration
Breaking changes
None in the release notes.
Security changes
- security Fixes GHSA-gx3v-3x3v-f8r5: Insufficient Isolation in Workflow Expression Evaluation in 2.45.5
- security Fixes GHSA-f2cw-9483-7vcp: Insecure GraphicsMagick Configuration in 2.45.5
- security Fixes GHSA-jmcg-c7p5-q69g: NocoDB Node Sends Its API Token to Attacker-Chosen Hosts When Downloading Attachments in 2.45.5
- security Fixes GHSA-prmc-fg87-r4gh: Credential-Using Nodes Forward Authentication Headers on Cross-Origin Redirects in 2.45.5
- security Fixes GHSA-pwj5-wwm6-g83j: Chat Trigger Embedded Chat Does Not Enforce n8n User Auth on All Requests in 2.45.5
- security Fixes GHSA-9qx8-fhxv-w794: Browser Use Upload Tool Reads Arbitrary Files from the n8n Server in 2.45.5
- security Fixes GHSA-4v22-g448-h4rg: MongoDB Node Update Operations Can Modify Unintended Documents in 2.45.5
- security Fixes GHSA-rc3w-8jc8-7x3w: Open Redirect via MCP OAuth Dynamic Client Registration in 2.45.5
- security Fixes GHSA-426f-xmcv-g8pg: OAuth Account Hijack in the End-User Credential Connect Flow via Unauthenticated Callback in 2.45.5
Every release in between
securityFixes GHSA-gx3v-3x3v-f8r5: Insufficient Isolation in Workflow Expression Evaluation
securityFixes GHSA-f2cw-9483-7vcp: Insecure GraphicsMagick Configuration
securityFixes GHSA-jmcg-c7p5-q69g: NocoDB Node Sends Its API Token to Attacker-Chosen Hosts When Downloading Attachments
securityFixes GHSA-prmc-fg87-r4gh: Credential-Using Nodes Forward Authentication Headers on Cross-Origin Redirects
securityFixes GHSA-pwj5-wwm6-g83j: Chat Trigger Embedded Chat Does Not Enforce n8n User Auth on All Requests
securityFixes GHSA-9qx8-fhxv-w794: Browser Use Upload Tool Reads Arbitrary Files from the n8n Server
securityFixes GHSA-4v22-g448-h4rg: MongoDB Node Update Operations Can Modify Unintended Documents
securityFixes GHSA-rc3w-8jc8-7x3w: Open Redirect via MCP OAuth Dynamic Client Registration
securityFixes GHSA-426f-xmcv-g8pg: OAuth Account Hijack in the End-User Credential Connect Flow via Unauthenticated Callback
fixcore: Keep the ExpressionError name in minified builds () (b3192c6)
fixcore: Keep undefined values in QuickJS expression results () (532f645)
fixeditor: Align carets within split buttons () (61cbfea)
fixeditor: Improve first load speed () (8b6bdbb)
fixeditor: Match Evals Run Test button colors () (f594853)
fixeditor: Remove underlines from breadcrumb links () (127d65a)
fixeditor: Remove underlines from Data Table links () (619271c)
fixeditor: Stop Safari from opening its own context menu on the canvas () (28f9c9e)
featurecore: Make custom OTel attribute key prefixes configurable () (6071b12)