Skip to content

Commit 3d013d0

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-4c29-8rgm-jvjj GHSA-4vrq-3vrq-g6gg GHSA-qfc3-hm4j-7q77
1 parent 6bf2cde commit 3d013d0

3 files changed

Lines changed: 233 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-4c29-8rgm-jvjj/GHSA-4c29-8rgm-jvjj.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4c29-8rgm-jvjj",
4+
"modified": "2026-03-26T18:26:09Z",
5+
"published": "2026-03-26T18:26:09Z",
6+
"aliases": [
7+
"CVE-2026-33747"
8+
],
9+
"summary": "BuildKit's Malicious frontend can cause file escape outside of storage root",
10+
"details": "### Impact\nWhen using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context.\n\n### Patches\nThe issue has been fixed in v0.28.1+\n\n### Workarounds\nIssue requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known frontend image like `docker/dockerfile` is not affected.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/moby/buildkit"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.28.1"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/moby/buildkit"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/moby/buildkit/releases/tag/v0.28.1"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-22"
55+
],
56+
"severity": "HIGH",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-03-26T18:26:09Z",
59+
"nvd_published_at": null
60+
}
61+
}

‎advisories/github-reviewed/2026/03/GHSA-4vrq-3vrq-g6gg/GHSA-4vrq-3vrq-g6gg.json‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4vrq-3vrq-g6gg",
4+
"modified": "2026-03-26T18:27:49Z",
5+
"published": "2026-03-26T18:27:49Z",
6+
"aliases": [
7+
"CVE-2026-33748"
8+
],
9+
"summary": "BuildKit Git URL subdir component can cause access to restricted files",
10+
"details": "### Impact\nInsufficient validation of Git URL fragment subdir components (`<url>#<ref>:<subdir>`, [docs](https://docs.docker.com/build/concepts/context/#url-fragments)) may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem.\n\n### Patches\nThe issue has been fixed in version v0.28.1\n\n### Workarounds\nThe issue affects only builds that use Git URLs with a subpath component. Avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/moby/buildkit"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.28.1"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://docs.docker.com/build/concepts/context/#url-fragments"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/moby/buildkit"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/moby/buildkit/releases/tag/v0.28.1"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-22",
59+
"CWE-59"
60+
],
61+
"severity": "HIGH",
62+
"github_reviewed": true,
63+
"github_reviewed_at": "2026-03-26T18:27:49Z",
64+
"nvd_published_at": null
65+
}
66+
}

‎advisories/github-reviewed/2026/03/GHSA-qfc3-hm4j-7q77/GHSA-qfc3-hm4j-7q77.json‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qfc3-hm4j-7q77",
4+
"modified": "2026-03-26T18:28:44Z",
5+
"published": "2026-03-26T18:28:44Z",
6+
"aliases": [
7+
"CVE-2026-33749"
8+
],
9+
"summary": "n8n Vulnerable to XSS via Binary Data Inline HTML Rendering",
10+
"details": "## Impact\nAn authenticated user with permission to create or modify workflows could craft a workflow that produces an HTML binary data object without a filename. The `/rest/binary-data` endpoint served such responses inline on the n8n origin without `Content-Disposition` or `Content-Security-Policy` headers, allowing the HTML to render in the browser with full same-origin JavaScript access.\n\nBy sending the resulting URL to a higher-privileged user, an attacker could execute JavaScript in the victim's authenticated session, enabling exfiltration of workflows and credentials, modification of workflows, or privilege escalation to admin.\n\n## Patches\nThe issue has been fixed in n8n versions 1.123.27, 2.13.3, and 2.14.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Limit workflow creation and editing permissions to fully trusted users only.\n- Restrict network access to the n8n instance to prevent untrusted users from accessing binary data URLs.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L"
15+
},
16+
{
17+
"type": "CVSS_V4",
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H"
19+
}
20+
],
21+
"affected": [
22+
{
23+
"package": {
24+
"ecosystem": "npm",
25+
"name": "n8n"
26+
},
27+
"ranges": [
28+
{
29+
"type": "ECOSYSTEM",
30+
"events": [
31+
{
32+
"introduced": "0"
33+
},
34+
{
35+
"fixed": "1.123.27"
36+
}
37+
]
38+
}
39+
]
40+
},
41+
{
42+
"package": {
43+
"ecosystem": "npm",
44+
"name": "n8n"
45+
},
46+
"ranges": [
47+
{
48+
"type": "ECOSYSTEM",
49+
"events": [
50+
{
51+
"introduced": "2.14.0"
52+
},
53+
{
54+
"fixed": "2.14.1"
55+
}
56+
]
57+
}
58+
],
59+
"versions": [
60+
"2.14.0"
61+
]
62+
},
63+
{
64+
"package": {
65+
"ecosystem": "npm",
66+
"name": "n8n"
67+
},
68+
"ranges": [
69+
{
70+
"type": "ECOSYSTEM",
71+
"events": [
72+
{
73+
"introduced": "2.0.0-rc.0"
74+
},
75+
{
76+
"fixed": "2.13.3"
77+
}
78+
]
79+
}
80+
]
81+
}
82+
],
83+
"references": [
84+
{
85+
"type": "WEB",
86+
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-qfc3-hm4j-7q77"
87+
},
88+
{
89+
"type": "ADVISORY",
90+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33749"
91+
},
92+
{
93+
"type": "PACKAGE",
94+
"url": "https://github.com/n8n-io/n8n"
95+
}
96+
],
97+
"database_specific": {
98+
"cwe_ids": [
99+
"CWE-79"
100+
],
101+
"severity": "MODERATE",
102+
"github_reviewed": true,
103+
"github_reviewed_at": "2026-03-26T18:28:44Z",
104+
"nvd_published_at": "2026-03-25T19:16:51Z"
105+
}
106+
}

0 commit comments

Comments
 (0)