Description

Detects when, in the published version of an n8n workflow, a Webhook, Form Trigger or public Chat Trigger that does not authenticate who calls it leads to a Code node or to a node that reads or writes files on the n8n host. Anyone who can reach the trigger can start the workflow with data of their choosing, and that data can reach the node as its input, so an outsider can steer what the workflow's code works on and which files it reads or writes when their paths come from that input.

Detection Strategy

• Lists every workflow the API key's user can see through the n8n public API, all of them for an owner or admin key, and reads only the version of each one that is published

• Starts from the Webhook, Form Trigger and public Chat Trigger nodes that the trigger authentication rules report, skipping disabled ones, and follows their main connections forward, through every output of a node and through disabled nodes

• Keeps the nodes that run code, the Code node and its older Function forms, and the nodes that read or write files on disk, skipping disabled ones

• Reports a vulnerability when one of them is reached, and records in the evidence each such node with the first trigger, in node order, that reaches it; a workflow whose listing omits the published version field, or whose published version has no node list or no connections, is recorded as unreadable rather than reported as clean