{"id":"GHSA-9qx8-fhxv-w794","kind":"vulnerability","aliases":["GHSA-9qx8-fhxv-w794"],"related":[],"title":"Browser Use Upload Tool Reads Arbitrary Files from the n8n Server","description":"## Impact\n\nWhen the Browser Use feature is enabled, the `browser_upload` tool accepted absolute file paths and passed them to Playwright. Because the browser session is connected remotely, Playwright resolved and read those paths on the n8n server rather than on the user's machine. An authenticated member who connects their own browser session could supply arbitrary absolute paths and have the file contents delivered into the page the assistant drives, where they could be retrieved. The approval prompt shown to the user named only the active page host; the file path was never surfaced or gated. Files readable by the n8n process user, including instance configuration files, were within scope.\n\nExploitation requires that Browser Use is explicitly enabled on the instance (`N8N_INSTANCE_AI_BROWSER_USE_ENABLED=true`).\n\n## Patches\n\nThe issue has been fixed in n8n versions 2.46.1, 2.45.5 and 3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Disable the Browser Use feature by setting `N8N_INSTANCE_AI_BROWSER_USE_ENABLED=false` or leaving it unset.\n- Restrict n8n instance access to fully trusted users only.\n- Remove `global:member` access from any users who are not fully trusted until the instance is patched.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","summary":"When n8n's Browser Use feature is enabled, the browser_upload tool accepted absolute file paths and let Playwright read them from the n8n server. An authenticated member can have files readable by the n8n process, including instance configuration files, delivered into the page the assistant drives.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"n8n","fixed":[">= 2.46.1"],"affected":"< 2.46.1","ecosystem":"npm"},{"name":"n8n","fixed":[">= 2.45.5"],"affected":"< 2.45.5","ecosystem":"npm"},{"name":"n8n","fixed":[">= 3.0.1"],"affected":"< 3.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ai-agents","ai-tooling","browser-use","n8n","self-hosted"],"not_affected_if":["browser-use-disabled","default-config","members-trusted"],"how_to_check":"- Check whether `N8N_INSTANCE_AI_BROWSER_USE_ENABLED` is set to `true` in the n8n environment\n- Check the n8n version with `n8n --version` against the fixed ranges below","fix":null,"status":"open","published_at":"2026-10-28T08:48:04+00:00","first_seen_at":"2026-11-09T22:53:26+00:00","triaged_at":"2026-11-09T22:55:10+00:00","updated_at":"2026-11-09T22:55:10+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-09T22:55:10Z","model":"claude-haiku-5-5","output":{"fix":"- npm `n8n`: upgrade to `2.46.1` (2.x line), `2.45.5` (2.45 line) or `3.0.1` (3.x line) or later\n- Workaround until patched: set `N8N_INSTANCE_AI_BROWSER_USE_ENABLED=false` or leave it unset","reach":"network","title":"n8n: Browser Use upload tool reads arbitrary server files via Playwright","impact":"medium","summary":"When n8n's Browser Use feature is enabled, the browser_upload tool accepted absolute file paths and let Playwright read them from the n8n server. An authenticated member can have files readable by the n8n process, including instance configuration files, delivered into the page the assistant drives.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["n8n","self-hosted","browser-use","ai-agents"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Server files readable by n8n user, including config, are exfiltrated","analyst_note":"","how_to_check":"- Check whether `N8N_INSTANCE_AI_BROWSER_USE_ENABLED` is set to `true` in the n8n environment\n- Check the n8n version with `n8n --version` against the fixed ranges below\n- unknown if the sources give further checks","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["browser-use-disabled","default-config","members-trusted"],"who_is_affected":"Only instances where the Browser Use feature is explicitly enabled with N8N_INSTANCE_AI_BROWSER_USE_ENABLED=true are exploitable. The attacker must be an authenticated member (global:member or higher) who connects their own browser session. Instances with Browser Use left off or unset are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000847,"input_tokens":5079,"output_tokens":679,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'2.45.5':224C '2.46.1':223C '3.0.1':226C '9qx8':14A,19A 'absolut':51B,98C,142C 'accept':50B,97C 'access':276C,285C 'activ':171C 'administr':248C 'agent':27B 'ai':26B,29B,209C,264C 'ai-ag':25B 'ai-tool':28B 'approv':162C 'arbitrari':6A,141C 'assist':83B,154C 'authent':64B,131C 'browser':1A,32B,41B,47B,88C,94C,108C,137C,199C,210C,257C,265C 'browser-us':31B 'configur':76B,191C 'connect':111C,134C 'consid':250C 'content':148C 'could':139C,158C 'deliv':78B,149C 'disabl':255C 'drive':84B,155C 'enabl':45B,92C,203C,212C,267C 'explicit':202C 'exploit':196C 'fals':268C 'featur':43B,90C,259C 'fhxv':15A,20A 'file':7A,52B,68B,77B,99C,147C,175C,182C,192C 'fix':219C 'follow':252C 'fulli':278C,292C,303C 'gate':181C 'ghsa':13A,18A 'ghsa-9qx8-fhxv-w794':12A,17A 'global':283C 'host':37B,173C 'immedi':246C 'impact':85C 'includ':74B,189C 'instanc':75B,190C,206C,208C,263C,275C,296C 'issu':216C 'later':236C 'leav':270C 'let':55B 'machin':129C 'measur':317C 'member':65B,132C,284C 'mitig':254C,316C 'n8n':10A,22A,23A,24A,34B,39B,61B,72B,121C,186C,207C,221C,262C,274C 'name':168C 'never':178C 'one':231C 'page':81B,152C,172C 'pass':102C 'patch':214C,298C 'path':53B,100C,118C,143C,176C 'playwright':56B,105C,113C 'possibl':247C 'process':73B,187C 'prompt':163C 'rather':123C 'read':5A,57B,116C 'readabl':69B,183C 'remedi':238C,304C 'remot':112C 'remov':282C 'requir':197C 'resolv':114C 'restrict':273C 'retriev':160C 'risk':306C 'scope':195C 'self':36B 'self-host':35B 'server':11A,62B,122C 'session':109C,138C 'set':261C 'short':314C 'short-term':313C 'shown':164C 'suppli':140C 'surfac':179C 'temporari':253C 'term':315C 'tool':4A,30B,49B,96C 'true':213C 'trust':279C,293C 'unset':272C 'upgrad':229C,243C 'upload':3A,48B,95C 'use':2A,33B,42B,89C,200C,211C,258C,266C,311C 'user':127C,167C,188C,227C,280C,288C 'version':222C,234C 'vulner':240C 'w794':16A,21A 'within':194C 'workaround':241C,300C","nicknames":[],"mitigations":[],"who_affected":"Only instances where the Browser Use feature is explicitly enabled with N8N_INSTANCE_AI_BROWSER_USE_ENABLED=true are exploitable. The attacker must be an authenticated member (global:member or higher) who connects their own browser session. Instances with Browser Use left off or unset are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["n8n"],"ptokens":["n8n"],"labels":["aiagents","aitooling","browseruse","medium","n8n","npm","selfhosted"],"campaign_type":null,"search_a":"'9qx8':14A,19A 'arbitrari':6A 'browser':1A 'fhxv':15A,20A 'file':7A 'ghsa':13A,18A 'ghsa-9qx8-fhxv-w794':12A,17A 'n8n':10A,22A,23A,24A 'read':5A 'server':11A 'tool':4A 'upload':3A 'use':2A 'w794':16A,21A","search_b":"'absolut':51B 'accept':50B 'agent':27B 'ai':26B,29B 'ai-ag':25B 'ai-tool':28B 'assist':83B 'authent':64B 'browser':32B,41B,47B 'browser-us':31B 'configur':76B 'deliv':78B 'drive':84B 'enabl':45B 'featur':43B 'file':52B,68B,77B 'host':37B 'includ':74B 'instanc':75B 'let':55B 'member':65B 'n8n':34B,39B,61B,72B 'page':81B 'path':53B 'playwright':56B 'process':73B 'read':57B 'readabl':69B 'self':36B 'self-host':35B 'server':62B 'tool':30B,49B 'upload':48B 'use':33B,42B","search_c":"'2.45.5':224C '2.46.1':223C '3.0.1':226C 'absolut':98C,142C 'accept':97C 'access':276C,285C 'activ':171C 'administr':248C 'ai':209C,264C 'approv':162C 'arbitrari':141C 'assist':154C 'authent':131C 'browser':88C,94C,108C,137C,199C,210C,257C,265C 'configur':191C 'connect':111C,134C 'consid':250C 'content':148C 'could':139C,158C 'deliv':149C 'disabl':255C 'drive':155C 'enabl':92C,203C,212C,267C 'explicit':202C 'exploit':196C 'fals':268C 'featur':90C,259C 'file':99C,147C,175C,182C,192C 'fix':219C 'follow':252C 'fulli':278C,292C,303C 'gate':181C 'global':283C 'host':173C 'immedi':246C 'impact':85C 'includ':189C 'instanc':190C,206C,208C,263C,275C,296C 'issu':216C 'later':236C 'leav':270C 'machin':129C 'measur':317C 'member':132C,284C 'mitig':254C,316C 'n8n':121C,186C,207C,221C,262C,274C 'name':168C 'never':178C 'one':231C 'page':152C,172C 'pass':102C 'patch':214C,298C 'path':100C,118C,143C,176C 'playwright':105C,113C 'possibl':247C 'process':187C 'prompt':163C 'rather':123C 'read':116C 'readabl':183C 'remedi':238C,304C 'remot':112C 'remov':282C 'requir':197C 'resolv':114C 'restrict':273C 'retriev':160C 'risk':306C 'scope':195C 'server':122C 'session':109C,138C 'set':261C 'short':314C 'short-term':313C 'shown':164C 'suppli':140C 'surfac':179C 'temporari':253C 'term':315C 'tool':96C 'true':213C 'trust':279C,293C 'unset':272C 'upgrad':229C,243C 'upload':95C 'use':89C,200C,211C,258C,266C,311C 'user':127C,167C,188C,227C,280C,288C 'version':222C,234C 'vulner':240C 'within':194C 'workaround':241C,300C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T08:48:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-9qx8-fhxv-w794","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-9qx8-fhxv-w794","severity":"medium","published_at":"2026-10-28T08:48:04+00:00","modified_at":"2026-10-28T08:48:04+00:00","first_seen_at":"2026-11-09T22:53:26+00:00","fetched_at":"2026-11-09T22:53:26+00:00","note":null}],"documents":[{"id":110634,"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-9qx8-fhxv-w794","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}