n8n-io/n8n free scan: 10 vulnerable dependencies, 1 committed secret

n8n-io/n8n ↗ · fca3170 · Aug 21, 2026, 10:20 PM

Hard evidence: 2 issues need attention now.

Free scan · deterministic evidence only

1 committed secret and 1 critical dependency vulnerability found. 11 more dimensions need Audit for the full picture.

500 of 27113 files scanned (1%) — this snapshot was truncated: this audit's size limit was reached, so some source was left unread.

What this means

Two scanners read 500 of 27113 files, starting with the highest-priority ones: one for committed credentials, one for known vulnerabilities in your dependencies. They found 1 committed credential on production paths and 1 high or critical vulnerability in runtime dependencies. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep Verification is the tier that issues a verdict. This scan does not.

Read it:

Secrets committed on production paths

1 found · 1 file

secretGeneric hardcoded secretpackages/@n8n/client-oauth2/src/client-oauth2-token.ts:54

const token …en=' + this.accessToken;

Packages you ship with known vulnerabilities

1 found · 1 package

cvenpm nodemailer@8.0.10GHSA-p6gq-j5cr-w38f

Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message — HIGH

Worth knowing, not blocking

57 found · 7 files · 6 packages · 48 in tests

Context only — test/example secrets, dev-only or moderate/low CVEs. Never verdict-forcing.

test fixtureGeneric hardcoded secret46 in 7 files

packages/@n8n/ai-workflow-builder.ee/evaluations/__tests__/webhook.test.ts:70, :80, :100, :117, :125, :138, :146, :581, :611, :695

:70 — const secret…234'; — non-production path

:80 — const secret…234'; — non-production path

:100 — const secret…678'; — non-production path

:117 — const secret…234'; — non-production path

:125 — const secret…234'; — non-production path

:138 — const secret…234'; — non-production path

:146 — const secret…234'; — non-production path

:581 — webhookSecret…234', — non-production path

:611 — const secret…234'; — non-production path

:695 — webhookSecret…234', — non-production path

packages/@n8n/api-types/src/dto/auth/__tests__/login-request.dto.test.ts:10, :18, :25, :34, :50, :65, :80

:10 — passwo…123', — non-production path

:18 — passwo…123', — non-production path

:25 — passwo…123', — non-production path

:34 — passwo…123', — non-production path

:50 — passwo…123', — non-production path

:65 — passwo…123', — non-production path

:80 — passwo…123', — non-production path

packages/@n8n/api-types/src/dto/password-reset/__tests__/change-password-request.dto.test.ts:9, :10, :16, :17, :31, :36, :41, :46, :52, :60, :68, :69, :76, :77, :94, :95, :105, :106

:9 — token:…gth', — non-production path

:10 — passwo…123', — non-production path

:16 — token:…ken', — non-production path

:17 — passwo…123', — non-production path

:31 — request: { passwo…123' }, — non-production path

:36 — request: { token: '', passwo…123' }, — non-production path

:41 — request: { token: 'short', passwo…123' }, — non-production path

:46 — request: { token:…ken' }, — non-production path

:52 — token:…ken', — non-production path

:60 — token:…ken', — non-production path

:68 — token:…ken', — non-production path

:69 — passwo…ord', — non-production path

:76 — token:…ken', — non-production path

:77 — passwo…123', — non-production path

:94 — token:…ken', — non-production path

:95 — passwo…123', — non-production path

:105 — token:…)_+', — non-production path

:106 — passwo…123', — non-production path

packages/@n8n/api-types/src/dto/password-reset/__tests__/resolve-password-token-query.dto.test.ts:8

:8 — request: { token:…ken' }, — non-production path

packages/@n8n/api-types/src/dto/user/__tests__/password-update-request.dto.test.ts:6, :18, :30, :31, :41, :42

:6 — newPasswo…123', — non-production path

:18 — currentPasswo…123', — non-production path

:30 — currentPasswo…123', — non-production path

:31 — newPasswo…123', — non-production path

:41 — currentPasswo…123', — non-production path

:42 — newPasswo…123', — non-production path

packages/@n8n/client-oauth2/test/config.ts:6, :9

:6 — export const accessToken …403'; — non-production path

:9 — export const refreshedRefreshToken …ndt'; — non-production path

packages/@n8n/client-oauth2/test/credential-options.test.ts:14, :28

:14 — client…ret', — non-production path

:28 — client…ret', — non-production path

test fixtureSlack Webhook2 in 1 file

packages/@n8n/ai-workflow-builder.ee/evaluations/__tests__/webhook.test.ts:158, :318

:158 — validateWebhookUrl('https:…/xxx'), — non-production path

:318 — expect(() => validateWebhookUrl('https:…/xxx')).not.toThrow(); — non-production path

dev depnpm vite3 in 1 version

8.0.2 — GHSA-4w7w-66w2-5vf9, GHSA-fx2h-pf6j-xcff, GHSA-p9ff-h696-f583

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling — devDependency

vite: `server.fs.deny` bypass on Windows alternate paths — devDependency

Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket — devDependency

moderate cvenpm markdown-it2 in 1 version

13.0.2 — GHSA-38c4-r59v-3vqw, GHSA-6v5v-wf23-fmfq

markdown-it is has a Regular Expression Denial of Service (ReDoS) — MODERATE

markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations — MODERATE

moderate cvenpm element-plus@2.4.3GHSA-5m5x-9j46-h678

Element Plus Link component (el-link) implements insufficient input validation for the href attribute — MODERATE

dev depnpm mjml@4.15.3GHSA-45h5-66jx-r2wf

MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827 — devDependency

dev depnpm rollup@2.79.2GHSA-mw96-cpmx-2vgc

Rollup 4 has Arbitrary File Write via Path Traversal — devDependency

dev depnpm storybook@10.1.11GHSA-mjf5-7g4m-gx5w

Storybook Dev Server is Vulnerable to WebSocket Hijacking — devDependency

AI audit · n8n-io/n8n · 14 dimensions · usually within 15 minutes*

Audit — your first Audit is free. After that, about $5.Needs a free GitHub or Google sign-inThe free scan stays unlimited

14 things unaudited

Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.

The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.

SecurityPriority: Core

Privacy & CompliancePriority: Core

Reliability & ResiliencePriority: Core

Code Quality & ArchitecturePriority: Important

AI / Vibe Coding RiskPriority: Important

Performance & ScalabilityPriority: Important

Infrastructure & DevOpsPriority: Important

Data LayerPriority: Important

Business & Product RiskPriority: Supporting

Developer ExperiencePriority: Supporting

Accessibility & UXPriority: Supporting

ObservabilityPriority: Supporting

Maintainability ForecastPriority: Specialized

IP & Novelty ExposurePriority: Specialized

Modules run (2)

Hardcoded Secret ScanDependency Vulnerability Scan

Hover a module for why it was selected. See every check nittim can run.

Scanned 500 of 27113 files (highest-priority subset) · n8n-io/n8n
Dependency manifests: 89 package roots found, 6 scanned; 2 Python manifests read — package list truncated at the vulnerability-lookup limit.

README badge

[![nittim](https://nittim.com/api/badge/n8n-io/n8n)](https://nittim.com/library/n8n-io/n8n)