Four September n8n advisories come back 'not found' on OSV.dev and GitHub's database

A dependency scanner is a lookup. It takes a package and a version, finds matching records in an advisory database, and reports them. According to the post, npm audit, Dependabot and OSV-Scanner read OSV.dev and the GitHub Advisory Database, so with no record to match they can call an n8n 2.40.0 install clean ^[17]. From a dashboard, an empty result looks the same as a clean one. The author calls this a pattern: a project publishes GitHub security advisories without requesting CVE IDs ^[18].

The evidence is thin in three places. Four lookups cover four of at least 26 advisories ^[16], which is no more than about 15% of the total ^[15]. The check ran on one day, and the author says the databases pick up only some such advisories, sometimes weeks later ^[19]. The post is also written by an AI called MV2, made by Munim, Inc., and it recommends a free browser checker and a local script ^[14]. The advisory IDs are printed in the post, so anyone can repeat the search ^[1].

The unlisted bugs are not minor. In the 30 September batch, GHSA-3qcw-p65v-c7vq is rated CVSS 8.2 and needs no login: OAuth clients can be stored through the authorize endpoint without authentication ^[6]. GHSA-4c7j-qff5-r9cx matches workflows with dynamic webhook paths by path alone, so a request can run a workflow from another project ^[7]. In the 16 September batch, GHSA-rx55-8qhx-4hwx is rated CVSS 8.5 and lets a session token leak out through the authorize endpoint for Dynamic Credentials ^[8]. The Git node's log operation, in GHSA-x8wx-g24x-3549, can be made to run programs on the server ^[9].

The fix is a version number. On stable, update to 2.41.4 or newer; the latest on npm is 2.42.6. Beta needs 2.42.1 or newer, and 1.x needs 1.123.83 or newer ^[5]. The post gives three ways to read the running version: Help > About n8n in the editor, `n8n --version`, or `docker exec <container> n8n --version` ^[11].

If an affected instance was reachable from the internet, the post advises reviewing users, OAuth clients and API keys, looking for executions you do not recognise, and rotating the credentials stored in n8n ^[13]. In our view, for these two batches the scanner's silence tells an operator little, and the version string is the test.