From 146968bcfd84ffe299b28291a1000aaef5e92caa Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 28 Apr 2025 21:04:22 +0000
Subject: [PATCH] Publish GHSA-c8hm-hr8h-5xjw

---
 .../GHSA-c8hm-hr8h-5xjw.json                  | 69 +++++++++++++++++++
 1 file changed, 69 insertions(+)
 create mode 100644 advisories/github-reviewed/2025/04/GHSA-c8hm-hr8h-5xjw/GHSA-c8hm-hr8h-5xjw.json

diff --git a/advisories/github-reviewed/2025/04/GHSA-c8hm-hr8h-5xjw/GHSA-c8hm-hr8h-5xjw.json b/advisories/github-reviewed/2025/04/GHSA-c8hm-hr8h-5xjw/GHSA-c8hm-hr8h-5xjw.json
new file mode 100644
index 00000000000..84c9352f314
--- /dev/null
+++ b/advisories/github-reviewed/2025/04/GHSA-c8hm-hr8h-5xjw/GHSA-c8hm-hr8h-5xjw.json
@@ -0,0 +1,69 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-c8hm-hr8h-5xjw",
+  "modified": "2025-04-28T21:02:23Z",
+  "published": "2025-04-28T21:02:23Z",
+  "aliases": [
+    "CVE-2025-46343"
+  ],
+  "summary": "n8n Vulnerable to Stored XSS through Attachments View Endpoint",
+  "details": "### Impact\nn8n workflows can store and serve binary files, which are accessible to authenticated users. However, there was no restriction on the MIME type of uploaded files, and the MIME type could be controlled via a GET parameter. This allowed the server to respond with any MIME type, potentially enabling malicious content to be interpreted and executed by the browser.\n\nAn authenticated attacker with member-level permissions could exploit this by uploading a crafted HTML file containing malicious JavaScript. When another user visits the binary data endpoint with the MIME type set to text/html, the script executes in the context of the user’s session. This script could, for example, send a request to change the user’s email address in their account settings, effectively enabling account takeover.\n\n### Patches\n\n- [n8n@1.90.0](https://github.com/n8n-io/n8n/releases/tag/n8n%401.90.0)\n\n### Credit\nWe would like to thank @Mahmoud0x00 for reporting this issue.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "n8n"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.90.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-c8hm-hr8h-5xjw"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/n8n-io/n8n/pull/14350"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/n8n-io/n8n/pull/14685"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/n8n-io/n8n"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/n8n-io/n8n/releases/tag/n8n%401.90.0"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-04-28T21:02:23Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file