CyberRota Analysis
AI-Generatedn8n versions prior to 1.123.67, 2.31.5, and 2.32.1 are vulnerable to a prototype pollution issue in the VM expression engine, which allows authenticated users to manipulate the engine's array-element access. This exploitation can lead to a sandbox escape and potential denial of service in both self-hosted and cloud environments. Organizations using affected versions should prioritize patching to mitigate the risk of service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able to create or edit a workflow expression can abuse the engine's array-element access to obtain a reference to a host built-in and pollute its prototype in the main n8n process (a sandbox escape), leading to a denial of service. Both self-hosted and cloud instances running the VM expression engine are affected.