---
id: "GHSA-f2cw-9483-7vcp"
page: "https://infrastack.ai/live/GHSA-f2cw-9483-7vcp"
kind: "vulnerability"
aliases: ["GHSA-f2cw-9483-7vcp"]
title: "Insecure GraphicsMagick Configuration"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "n8n", "fixed": [">= 1.123.89"], "affected": "< 1.123.89", "ecosystem": "npm"}, {"name": "n8n", "fixed": [">= 2.46.1"], "affected": "< 2.46.1", "ecosystem": "npm"}, {"name": "n8n", "fixed": [">= 2.45.5"], "affected": "< 2.45.5", "ecosystem": "npm"}, {"name": "n8n", "fixed": [">= 3.0.1"], "affected": "< 3.0.1", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["docker", "graphicsmagick", "n8n", "package", "self-hosted"]
not_affected_if: ["auth-required", "fixed-version", "no-edit-image-node"]
published_at: "2026-10-28T08:47:32+00:00"
first_seen_at: "2026-11-09T22:53:25+00:00"
updated_at: "2026-11-09T22:54:15+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-f2cw-9483-7vcp", "first_seen_at": "2026-11-09T22:53:25+00:00"}]
exploit_sources: []
---

# Insecure GraphicsMagick Configuration

Link for people: https://infrastack.ai/live/GHSA-f2cw-9483-7vcp (this .md is for agents)

The GraphicsMagick image library bundled in the official n8n Docker image has known vulnerabilities in some of its components. Processing untrusted images with the Edit Image node can lead to remote code execution on the n8n instance.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:n8n affected < 1.123.89 fixed >= 1.123.89
- npm:n8n affected < 2.46.1 fixed >= 2.46.1
- npm:n8n affected < 2.45.5 fixed >= 2.45.5
- npm:n8n affected < 3.0.1 fixed >= 3.0.1

## How to check

- Check the n8n version with `n8n --version` or the image tag in your Docker deployment.
- Look for workflows that use the Edit Image node (`n8n-nodes-base.editImage`) fed by a Webhook node or other untrusted input.
- Check whether `NODES_EXCLUDE` includes `n8n-nodes-base.editImage`.

## Fix

- n8n `1.123.89`
- n8n `2.45.5`
- n8n `2.46.1`
- n8n `3.0.1`

## Timeline

- 2026-11-09T22:53:25+00:00 ghsa-repo https://github.com/n8n-io/n8n/security/advisories/GHSA-f2cw-9483-7vcp

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/n8n-io/n8n/security/advisories/GHSA-f2cw-9483-7vcp

## From the sources

## Impact

The version of GraphicsMagick bundled in the official n8n Docker image is affected by known vulnerabilities in some of its components. Processing untrusted images with the Edit Image node could lead to remote code execution on the n8n instance.

## Patches

The issue has been fixed in n8n versions 1.123.89, 2.45.5, 2.46.1 and v3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

## Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Audit active workflows and deactivate any workflow that connects an unauthenticated Webhook node to an Edit Image node.
- Apply network-level controls to restrict access to webhook endpoints that feed into Edit Image workflows.
- Remove the GraphicsMagick coder modules for `url`, `svg`, `mvg`, `pcd`, and `msl` from the n8n container if those formats are not required.
- Disable the Edit Image node by adding `n8n-nodes-base.editImage` to the `NODES_EXCLUDE` environment variable if it is not required.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_