registry / @aiteza/n8n-nodes-aiteza / 1.1.1

@aiteza/n8n-nodes-aiteza@1.1.1

n8n Community Node for the AITEZA REST API (Datarooms, Files, Chat, Search, Workflows)

AI Security Review

scanned 5h ago · by lpm-firewall-ai

An unauthenticated default trigger can accept a caller-controlled callback URL. Downstream progress/result nodes can POST workflow data and callback tokens to that URL.

Static reason

No blocking static signals were detected.

Trigger

A request reaches an AITEZA Trigger workflow configured with Progress or Workflow Result nodes.

Impact

SSRF and exfiltration of downstream workflow result data.

Mechanism

Caller-controlled callback URL used for outbound POSTs

Rationale

The package is not malicious, but source confirms an unguarded webhook-to-caller-controlled callback flow with data disclosure potential. This warrants a warning for a concrete vulnerability.

Evidence

package.jsondist/nodes/Aiteza/AitezaTrigger.node.jsdist/nodes/Aiteza/AitezaProgress.node.jsdist/nodes/Aiteza/AitezaWorkflowResult.node.jsdist/nodes/Aiteza/GenericFunctions.js

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

Trigger webhook authentication is optional in dist/nodes/Aiteza/AitezaTrigger.node.js.

@aiteza/n8n-nodes-aiteza@1.1.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code