CVE-2026-110848
CVE-2026-110848 · n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named __proto__ through the API and invoke the connect-nodes operation to pollute the global object prototype, disrupting the instance until restart.
CVSS 6.0 · Media · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
n8n
- Versiones
- ≥ 0, < 1.123.83: Afectada (semver)
- ≥ 2.0.0, < 2.41.4: Afectada (semver)
- ≥ 2.42.0, < 2.42.1: Afectada (semver)
Actualiza a 1.123.83; Actualiza a 2.41.4; Actualiza a 2.42.1