n8n: Insecure GraphicsMagick Configuration

Impact

The version of GraphicsMagick bundled in the official n8n Docker image is affected by known vulnerabilities in some of its components. Processing untrusted images with the Edit Image node could lead to remote code execution on the n8n instance.

Patches

The issue has been fixed in n8n versions 1.123.89, 2.45.5, 2.46.1 and v3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Restrict n8n instance access to fully trusted users only.
• Audit active workflows and deactivate any workflow that connects an unauthenticated Webhook node to an Edit Image node.
• Apply network-level controls to restrict access to webhook endpoints that feed into Edit Image workflows.
• Remove the GraphicsMagick coder modules for url, svg, mvg, pcd, and msl from the n8n container if those formats are not required.
• Disable the Edit Image node by adding n8n-nodes-base.editImage to the NODES_EXCLUDE environment variable if it is not required.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.