CVE WatchNov 13, 2026

CVE-2026-126384

n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 bundles a GraphicsMagick version with known vulnerabiliti

CVSS

7.5

High

EPSS

—

KEV

—

Exploit Today

0-100

Published: Nov 13, 2026 · Last modified: Nov 13, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 bundles a GraphicsMagick version with known vulnerabilities in its official Docker image, which the Edit Image node uses to process images. Attackers who can supply crafted untrusted images to an Edit Image workflow, such as one fed by a Webhook node, can execute code on the n8n instance.

Official references

github.comhttps://github.com/n8n-io/n8n/security/advisories/GHSA-f2cw-9483-7vcp
www.vulncheck.comhttps://www.vulncheck.com/advisories/n8n-before-1.123.89-rce-via-bundled-graphicsmagick-in-edit-image-node

Related CVEs

No related CVEs by CWE or product.