CyberRota Analysis
AI-GeneratedThe n8n workflow automation platform is vulnerable to a prototype pollution issue that can be exploited via the REST API, allowing attackers to manipulate the Object.prototype and disrupt subsequent requests. This vulnerability affects versions prior to 2.37.7 and 2.38.2, and organizations using n8n for workflow automation should prioritize upgrading to the patched versions to mitigate potential disruptions and security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI workflow summary used node names and connection keys from stored workflows as ordinary object keys. A workflow submitted through the REST API could contain __proto__ or constructor, causing nested writes to reach Object.prototype in the main n8n process and disrupt later requests. The affected function is summarizeWorkflowStructure in packages/@n8n/instance-ai/src/tools/workflows/summarize-workflow.ts. This issue is fixed in versions 2.37.7 and 2.38.2.
Related CVEs
Other vulnerabilities affecting the same vendor(s)