Prototype Pollution in N8n-io N8n

CVE-2026-72769

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able to create or edit a workflow expression can abuse the engine's array-element access to obtain a re…

Vulnerability class: Prototype Pollution

Affected products

N8n-io N8n — versions 0, 1.123.67, 2.32.1

Weakness classification (CWE)

CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)