{"schema":"threatline.record/2","record":{"id":"GHSA-f2cw-9483-7vcp","aliases":["GHSA-f2cw-9483-7vcp"],"summary":"Insecure GraphicsMagick Configuration","details":"## Impact\r\n\r\nThe version of GraphicsMagick bundled in the official n8n Docker image is affected by known vulnerabilities in some of its components. Processing untrusted images with the Edit Image node could lead to remote code execution on the n8n instance.\r\n\r\n## Patches\r\n\r\nThe issue has been fixed in n8n versions 1.123.89, 2.45.5, 2.46.1 and v3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\r\n\r\n## Workarounds\r\n\r\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\r\n- Restrict n8n instance access to fully trusted users only.\r\n- Audit active workflows and deactivate any workflow that connects an unauthenticated Webhook node to an Edit Image node.\r\n- Apply network-level controls to restrict access to webhook endpoints that feed into Edit Image workflows.\r\n- Remove the GraphicsMagick coder modules for `url`, `svg`, `mvg`, `pcd`, and `msl` from the n8n container if those formats are not required.\r\n- Disable the Edit Image node by adding `n8n-nodes-base.editImage` to the `NODES_EXCLUDE` environment variable if it is not required.\r\n\r\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","categories":["Frameworks"],"product":"n8n","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-f2cw-9483-7vcp","source_modified_at":"2026-10-28T10:19:55Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 1.123.89"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-f2cw-9483-7vcp","source_modified_at":"2026-10-28T10:19:55Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.46.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-f2cw-9483-7vcp","source_modified_at":"2026-10-28T10:19:55Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.45.5"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-f2cw-9483-7vcp","source_modified_at":"2026-10-28T10:19:55Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 3.0.1"}],"fixed_versions":[],"cvss":7.7,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T08:47:32Z","modified_at":"2026-10-28T10:19:55Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-f2cw-9483-7vcp","fetched_at":"2026-10-28T15:55:58.673066Z","source_modified_at":"2026-10-28T10:19:55Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-28T10:19:55Z","content_hash":"aa42d2cebc946ef6b20936a7534cf74827aa2c59da45147050a55ff35eba63f3"}}