{"schema":"threatline.record/2","record":{"id":"GHSA-43v8-hjhm-chjp","aliases":["GHSA-43v8-hjhm-chjp"],"summary":"Chat Hub: chat-only users can register tool types the product already tries to sandbox","details":"## Impact\n\nChat Hub blocked only a few tool types for users with the chat user role. A chat user cannot create or edit workflows, but could still add Chat Hub tools that run code in the task runner sandbox, read and write files in the directories that n8n allows, or use the workflows, Data Tables and agents of the instance, and then run these tools through a chat. A chat user could therefore act beyond the limits of their role.\n\n## Patches\n\nThe issue has been fixed in n8n versions 1.123.85, 2.43.5, and 2.44.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict n8n instance access to fully trusted users only.\n- Do not assign the `global:chatUser` role to any user who is not fully trusted until the instance is patched.\n- Disable Chat Hub if it is not required.\n- Use the `NODES_EXCLUDE` environment variable to remove high-risk node types from the instance if they are not needed.\n- Enable `N8N_SSRF_PROTECTION_ENABLED=true` to reduce the impact of outbound request abuse.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","categories":["Frameworks"],"product":"n8n","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-43v8-hjhm-chjp","source_modified_at":"2026-10-14T09:43:15Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 1.123.85"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-43v8-hjhm-chjp","source_modified_at":"2026-10-14T09:43:15Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.44.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-43v8-hjhm-chjp","source_modified_at":"2026-10-14T09:43:15Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.43.5"}],"fixed_versions":[],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-14T09:43:15Z","modified_at":"2026-10-14T09:43:15Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-43v8-hjhm-chjp","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-14T09:43:15Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-14T09:43:15Z","content_hash":"ff651dc8f40d4fc3d9ca4fa17931a4a6df705af5461e60ee5200e59cd7b64eca"}}