CVE-2025-46343: n8n Vulnerable to Stored XSS through Attachments View Endpoint

The vulnerability description states that the MIME type of uploaded files could be controlled via a GET parameter, allowing the server to respond with any MIME type, leading to XSS. The provided patches consistently modify the get method within the BinaryDataController class, located in packages/cli/src/controllers/binary-data.controller.ts.

Initially, in commit 678fe7726a507c784c41da8f4011825a8b5f80e0, the get method was patched to add a Content-Security-Policy: sandbox header if the mimeType (derived from the GET request) was text/html and the action was view. This indicates that prior to this, no such sandboxing was applied, and the Content-Type was set directly based on the user-provided mimeType.

Subsequent commits, like 18d54ab17ddd32a030b7ec10ffe517169e3e09d9, further hardened this by introducing an allow-list (ViewableMimeTypes) for viewable content types and explicitly disallowing others (like text/html) for the 'view' action. This confirms that the get method was the point where the user-controlled mimeType was processed and used to set the response headers.

The vulnerability existed because the get method would take the mimeType from the request's query parameters and use it to set the Content-Type header without adequate validation, allowing an attacker to force the browser to interpret an uploaded file as HTML. Therefore, BinaryDataController.get is the vulnerable function as it directly handles the malicious input (the mimeType parameter) and produces the vulnerable output (HTTP response with a controlled Content-Type).