{"schema":"threatline.record/2","record":{"id":"GHSA-m7gv-mpg5-7c9v","aliases":["GHSA-m7gv-mpg5-7c9v"],"summary":"Read/Write Files Node Glob Pattern Causes Unbounded Event-Loop Block","details":"## Impact\r\n\r\nThe Read/Write Files from Disk node evaluated the File(s) Selector glob pattern on the main event loop with no time limit. A selector with many wildcards compiles to a regular expression with exponential backtracking. A member who can create and run workflows can submit such a pattern and block the n8n process, so the UI, API, webhooks and health checks stop responding until the process is restarted.\r\n\r\n## Patches\r\n\r\nThe issue has been fixed in n8n versions 1.123.85, 2.44.1, and 2.43.5. Users should upgrade to one of these versions or later to remediate the vulnerability.\r\n\r\n## Workarounds\r\n\r\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\r\n- Restrict n8n instance access to fully trusted users only.\r\n- Disable the Read/Write Files node by adding `n8n-nodes-base.readWriteFile` to the `NODES_EXCLUDE` environment variable if it is not required.\r\n- Audit existing workflows for Read/Write Files nodes with unusual File(s) Selector values and remove or correct them.\r\n\r\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","categories":["Frameworks"],"product":"n8n","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-m7gv-mpg5-7c9v","source_modified_at":"2026-10-14T09:36:05Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 1.123.85"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-m7gv-mpg5-7c9v","source_modified_at":"2026-10-14T09:36:05Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.44.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-m7gv-mpg5-7c9v","source_modified_at":"2026-10-14T09:36:05Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.43.5"}],"fixed_versions":[],"cvss":7.1,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-14T09:36:05Z","modified_at":"2026-10-14T09:36:05Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-m7gv-mpg5-7c9v","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-14T09:36:05Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-14T09:36:05Z","content_hash":"b946b9e43a03aab30c0def8c53e0e0d002514231d656e68e4a3fe820080e6d07"}}