MediumCode node loads external modules
The code imports modules, which requires the n8n instance to allow them (NODE_FUNCTION_ALLOW_EXTERNAL/BUILTIN) and widens what the code can do.
Confidence: high · Definite match
Suggested fix: Confirm each module is necessary and allow-listed explicitly on the n8n instance.
MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook).
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook).
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook).
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook).
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook).
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook).
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook).
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook).
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumPotential SSRF: user-influenced request URL
The request URL is dynamic and this node is reachable from a public entry point (Webhook).
Confidence: medium · Heuristic · Via real connections
Suggested fix: Validate the target against an allow-list of hosts before the request, and block private/loopback/link-local ranges on the n8n host.
MediumWebhook accepts unauthenticated requests
Anyone who learns the webhook URL can trigger this workflow with arbitrary data.
Confidence: medium · Heuristic
Suggested fix: Enable header or basic auth on the Webhook node, or verify a signature from the sending service.
