N8N · GHSA-f2cw-9483-7vcp · Package
FIX → >= 1.123.89 +3
The GraphicsMagick image library bundled in the official n8n Docker image has known vulnerabilities in some of its components. Processing untrusted images with the Edit Image node can lead to remote code execution on the n8n instance.
first public Oct 28, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted n8n instances that run the Edit Image node on images from untrusted sources, such as unauthenticated Webhook workflows, are exposed. Instances on versions listed as fixed, or that do not use the Edit Image node on untrusted input, are less exposed. Workflows that never process external images can be deprioritised.
Not affected if auth-required, fixed-version, no-edit-image-node
Who cares docker, graphicsmagick, n8n, self-hosted
n8n --version or the image tag in your Docker deployment.n8n-nodes-base.editImage) fed by a Webhook node or other untrusted input.The version of GraphicsMagick bundled in the official n8n Docker image is affected by known vulnerabilities in some of its components. Processing untrusted images with the Edit Image node could lead to remote code execution on the n8n instance.
The issue has been fixed in n8n versions 1.123.89, 2.45.5, 2.46.1 and v3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
url, svg, mvg, pcd, and msl from the n8n container if those formats are not required.n8n-nodes-base.editImage to the NODES_EXCLUDE environment variable if it is not required.Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NODES_EXCLUDE includes n8n-nodes-base.editImage.Upgrade to >= 1.123.89 +3
1.123.892.45.52.46.13.0.1These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.