n8n before 1.123.67 Prototype Pollution via VM Expression Engine
Impact
n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain a prototype pollution vulnerability in the VM expression engine, allowing an authenticated user to create or edit a workflow expression and potentially cause a denial of service. The vulnerability affects both self-hosted and cloud instances. An attacker needs access to create or edit workflow expressions.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
n8n-io · VulnCheck
n8n
2 ranges
n8n-io · VulnCheck
n8n
Package identity
pkg:npm/n8nExplore n8n →Identity supplied by VulnCheck. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → before 1.123.67
semver versions
unaffected
1.123.67
semver versions
Other versions: unaffected
n8n-io · VulnCheck
n8n
2 ranges
n8n-io · VulnCheck
n8n
Package identity
pkg:npm/n8nExplore n8n →Identity supplied by VulnCheck. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
2.32.0 → before 2.32.1
semver versions
unaffected
2.32.1
semver versions
Other versions: unaffected
n8n-io · VulnCheck
n8n
2 ranges
n8n-io · VulnCheck
n8n
Package identity
pkg:npm/n8nExplore n8n →Identity supplied by VulnCheck. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
2.0.0-rc.0 → before 2.31.5
semver versions
unaffected
2.31.5
semver versions
Other versions: unaffected
Original source description
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able to create or edit a workflow expression can abuse the engine's array-element access to obtain a reference to a host built-in and pollute its prototype in the main n8n process (a sandbox escape), leading to a denial of service. Both self-hosted and cloud instances running the VM expression engine are affected.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-72769View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
VulnCheck
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
VulnCheck · platform conditions
Any condition may hold
Vulnerable product
cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*Before: 1.123.67
Vulnerable product
cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*From (inclusive): 2.32.0
Before: 2.32.1
Vulnerable product
cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*From (inclusive): 2.0.0-rc.0
Before: 2.31.5
Original applicability statements
[
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "1.123.67"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "2.32.1",
"versionStartIncluding": "2.32.0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "2.31.5",
"versionStartIncluding": "2.0.0-rc.0"
}
]
}
]
}
]Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.