Saltar al contenido
QuenchWorks

n8n

Imagen · Workflow · standard · v2.40.7

F 43firmada con cosignSPDX SBOMprocedencia SLSAamd64 · arm64Reconstruida 2026-10-04

Fair-code workflow automation platform — build integrations and automations across 400+ apps via a visual node editor, with native AI/LLM agent nodes. Node build on a hardened nonroot Wolfi base; the flagged transitive npm CVE class is cleared image-side with pinned overrides.

Digest actual (desplegado por el chart)

sha256:cfb73b45037c7f9fdfd1294b9cc0e33eb515b495c654f4fc520b4ba89c2c091e

Las firmas, el SBOM y la procedencia se adjuntan a este digest. Fíjate a él para descargas reproducibles y a prueba de manipulaciones.

Imagen
ghcr.io/quenchworks/images/n8n:2.40.7
Firmada
cosign sin llave
SBOM
SPDX, en el digest
Procedencia
compilación SLSA
Arquitecturas
amd64, arm64
Se ejecuta como
nonroot (uid 1001)
Sistema de archivos raíz
solo lectura
Tamaño de la imagen
418.7 MB

Versiones publicadas

1 etiqueta

Cada etiqueta es un índice multiarquitectura (amd64 + arm64) fijado por digest. Etiquetada por versión, nunca :latest.

VersiónTamañoPublicadaDigest
2.40.7última418.7 MB2026-10-04sha256:cfb73b45037c…

Informe de seguridad (Trivy)

F· 0/10036 fixable · rebuild clears them

Detalle de vulnerabilidades

n8n 2.40.7 · 43 CVE
CVEGravedadPaqueteInstaladaCorregida enTítulo
CVE-2026-100721CRITICALvm23.11.73.12.2vm2: NodeVM custom resolution bypasses external path boundaries
CVE-2026-102828CRITICALsimple-git3.36.04.0.1simple-git: simple-git unsafe-operation guard does not block trailer command configuration
CVE-2026-102829CRITICAL@simple-git/argv-parser1.1.12.0.1simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
CVE-2026-106445CRITICALhandlebars4.7.94.7.10handlebars: Handlebars: JavaScript Injection via Own Property Check Bypass
CVE-2026-106446CRITICALhandlebars4.7.94.7.10handlebars: Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)
CVE-2026-92934CRITICALvm23.11.73.11.8vm2: vm2 before 3.11.8 Sandbox Escape RCE via AggregateError
CVE-2026-92953CRITICALvm23.11.73.11.8vm2: vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray
CVE-2026-92954CRITICALvm23.11.73.11.8vm2: vm2 3.10.0 through 3.11.5 Denial of Service via Host Promise
CVE-2026-92955CRITICALvm23.11.73.11.8vm2: vm2 before 3.11.8 Sandbox Escape via NodeVM
CVE-2026-93605CRITICALvm23.11.73.12.1vm2: vm2 NodeVM before 3.12.1 Remote Code Execution via child_process
CVE-2026-100722HIGHvm23.11.73.12.2vm2: vm2: Denial of Service via unhandled Promise rejection in construct trap
CVE-2026-102826HIGHsimple-git3.36.04.0.0simple-git: simple-git allows command execution through unblocked Git configuration includes
CVE-2026-102827HIGHsimple-git3.36.04.0.0simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
CVE-2026-104850HIGH@modelcontextprotocol/sdk1.26.01.31.0@modelcontextprotocol/sdk: @modelcontextprotocol/client: MCP TypeScript SDK: Information disclosure via unbound OAuth credentials
CVE-2026-87776HIGHcompression1.8.11.8.2compression: compression: Denial of Service via memory leak on premature response close
CVE-2026-92959HIGHvm23.11.73.11.8vm2: vm2: Asynchronous code execution bypass via Promise thenable assimilation
CVE-2026-93687HIGHbraces3.0.3— sin correcciónbraces: braces: Denial of Service via Stack Overflow from Deeply Nested Patterns
CVE-2026-100723MEDIUMvm23.11.73.12.2vm2: vm2: Information disclosure via zlib shared buffer pool
CVE-2026-104182MEDIUMstream-json3.5.03.6.0stream-json: stream-json: Denial of Service via inefficient comment scanning
CVE-2026-104183MEDIUMstream-json3.5.03.6.0stream-json: stream-json: Object prototype manipulation via crafted JSON input
CVE-2026-106119MEDIUM@langchain/mongodb1.0.11.3.1LangChain: MongoDBChatMessageHistory query injection can allow cross-session access
CVE-2026-106444MEDIUMhandlebars4.7.94.7.10handlebars: Handlebars: Cross-Site Scripting via unescaped closing script tags in precompiled templates
CVE-2026-86597MEDIUMsnowflake-sdk2.1.03.3.0Snowflake drivers writes sensitive information to logs
CVE-2026-8674MEDIUMglibc-2.442.44-r72.44-r8glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration
CVE-2026-8674MEDIUMglibc-2.44-locale-posix2.44-r72.44-r8glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration
CVE-2026-8674MEDIUMld-linux-2.442.44-r72.44-r8glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration
CVE-2026-86805MEDIUMglibc-2.442.44-r72.44-r8glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader
CVE-2026-86805MEDIUMglibc-2.44-locale-posix2.44-r72.44-r8glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader
CVE-2026-86805MEDIUMld-linux-2.442.44-r72.44-r8glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader
CVE-2026-89092MEDIUMglibc-2.442.44-r72.44-r8glibc: nscd stack overflow leads to degraded DNS resolution
CVE-2026-89092MEDIUMglibc-2.44-locale-posix2.44-r72.44-r8glibc: nscd stack overflow leads to degraded DNS resolution
CVE-2026-89092MEDIUMld-linux-2.442.44-r72.44-r8glibc: nscd stack overflow leads to degraded DNS resolution
CVE-2026-92933MEDIUMvm23.11.73.11.8vm2: vm2: Information Disclosure via util.getCallSites
CVE-2026-95818MEDIUMglibc-2.442.44-r72.44-r8glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.
CVE-2026-95818MEDIUMglibc-2.44-locale-posix2.44-r72.44-r8glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.
CVE-2026-95818MEDIUMld-linux-2.442.44-r72.44-r8glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.
CVE-2024-1899MEDIUMshowdown2.1.0— sin correcciónShowdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing
CVE-2025-57665MEDIUMelement-plus2.4.3— sin correcciónElement Plus Link component (el-link) implements insufficient input validation for the href attribute
CVE-2026-59710MEDIUMshowdown2.1.0— sin correcciónshowdown: Showdown: Stored Cross-Site Scripting via unescaped table header ID attributes in markdown
CVE-2026-59711MEDIUMshowdown2.1.0— sin correcciónshowdown: Showdown: Cross-site scripting via unescaped metadata title allows arbitrary code execution
CVE-2026-97058MEDIUMsprintf-js1.0.3— sin correcciónsprintf-js: sprintf-js: Denial of Service via unbounded precision specifiers
CVE-2026-97058MEDIUMsprintf-js1.1.3— sin correcciónsprintf-js: sprintf-js: Denial of Service via unbounded precision specifiers
CVE-2026-105799LOW@langchain/redis1.0.11.1.1LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values
10
Crítica
7
Alta
25
Media
1
Baja
0
Desconocida
fixable per nightly scan · peak 4161 of 104 days with any · 2026-06-29 to 2026-10-11

Descarga la imagen

Ejecútala directamente con Docker, Podman o cualquier carga de trabajo de Kubernetes. Sin root, sistema de archivos raíz de solo lectura, compilada para amd64 y arm64.

Descargar (etiqueta)

docker pull ghcr.io/quenchworks/images/n8n:2.40.7

Fijada por digest (recomendado)

docker pull ghcr.io/quenchworks/images/n8n@sha256:cfb73b45037c7f9fdfd1294b9cc0e33eb515b495c654f4fc520b4ba89c2c091e

Etiquetas

2.40.72.40.7-amd642.40.7-arm64

Las imágenes se etiquetan por versión de la app (nunca :latest): un índice multiarquitectura más etiquetas por arquitectura.

Versión de la app
2.40.7
Arquitecturas
amd64, arm64
Se ejecuta como
nonroot (uid 1001)
Sistema de archivos raíz
solo lectura
Licencia
LicenseRef-n8n-Sustainable-Use-License-1.0

Verifica la cadena de suministro

Esta imagen está firmada con cosign y lleva un SBOM SPDX y una atestación de procedencia de compilación SLSA en el mismo digest. Comprueba las tres tú mismo:

# 1. signature — built and signed by QuenchWorks CI
cosign verify ghcr.io/quenchworks/images/n8n:2.40.7 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. SLSA build provenance — which workflow built it, from what
cosign verify-attestation --type https://slsa.dev/provenance/v1 ghcr.io/quenchworks/images/n8n:2.40.7 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 3. SPDX SBOM — the package inventory
cosign verify-attestation --type https://spdx.dev/Document/v2.3 ghcr.io/quenchworks/images/n8n:2.40.7 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Consulta la guía de SBOM y procedencia para leer el SBOM y usar estas comprobaciones en CI.

Transparencia

Cada imagen lleva su SBOM y su procedencia como atestaciones en el mismo digest, verificables públicamente con los comandos anteriores (comprueban el paquete y el registro de transparencia de Sigstore, Rekor).

Ver el chart de HelmVer el paquete

Proyecto original: https://n8n.io