Vulnerabilities

Runtime Security Boundaries Require Runtime Enforcement: Lessons from n8n’s CVE Chain

by
Isometric diagram showing a dark server chassis with an expression evaluator unit. An empty mounting frame at the evaluator's input boundary has no barrier plate installed. An amber signal beam passes through the empty frame and strikes the execution module, which glows amber. Teal circuit traces terminate at the frame edge without connecting to the execution path.

n8n’s five critical CVEs in 90 days share a single architectural flaw: TypeScript type annotations used as runtime security enforcement — but TypeScript annotations don’t exist at JavaScript runtime. The patch for the first CVE was bypassed by the same mechanism two months later. If you build AI agent pipelines or any sandbox with compile-time security constraints, this CVE chain names the failure directly.

Stop Treating LLM Agents as Trusted Users: Lessons from GitLab CVE-2021-39935

by

CISA added CVE-2021-39935 to the KEV catalog on February 3, 2026 – a 2021 GitLab SSRF vulnerability now seeing active exploitation. The federal remediation deadline is February 24, 2026. This is worth examining not because it’s novel (GitLab patched it in October 2021), but because the threat model around CI/CD attack surfaces has fundamentally changed … Read more