CyberRota Analysis
AI-GeneratedThe vulnerability affects n8n versions prior to 1.123.69, 2.33.4, and 2.34.1, allowing authenticated users with access to the Code node to exploit prototype pollution in the JavaScript task runner VM. This can lead to arbitrary command execution within the runner container, with the potential for cross-tenant impact due to the process-wide nature of the corrupted prototype. Organizations using n8n, especially those with multi-tenant environments or enabled task runners, should prioritize patching to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit prototype pollution to execute arbitrary commands within the runner container. Because the polluted prototype is a process-wide object, the corruption persists across other tenants' Code node executions on the same shared runner. On v1.x instances without task runners enabled, Code node JavaScript runs directly in the main n8n process, where the impact could be higher.
Related CVEs
Other vulnerabilities affecting the same vendor(s)