GCVE-110-NCSC-2026-49

Advisory PublishedCVSS 7.7/10

Vulnetix · Advisory published February 9, 2026

n8n's task runner had a vulnerability allowing untrusted code to allocate uninitialized memory, which has been patched in versions 1.114.3 and 1.115.0 by ensuring zero-filled buffer allocations.

Download JSON Open in Console

Weaknesses (CWE)

CWE-200Exposure of Sensitive Information to an Unauthorized ActorCWE-913Improper Control of Dynamically-Managed Code ResourcesCWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionCWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CWE-434Unrestricted Upload of File with Dangerous TypeCWE-693Protection Mechanism FailureCWE-20Improper Input Validation

Risk Scores

CVSS 3.1

7.7/10

High · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected Products

Vendor	Product	Versions	Platforms
N8N	vers:unknown/*	—	—

Aliases

CVE-2025-61917 CVE-2026-21893 CVE-2026-25049 CVE-2026-25051 CVE-2026-25052 CVE-2026-25053 CVE-2026-25054 CVE-2026-25055 CVE-2026-25056 CVE-2026-25115

References

advisory

Browse GCVE Records

73,866 records in the GCVE database · Updated July 19, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON