GHSA-679f-58pq-4v2c: n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service

Summary

The Instance AI workflow summary in n8n built its result using get-or-create-then-nested-write logic keyed by node names and connection keys from stored workflows. Because the editor's restricted-name guard is client-side, an attacker can post a workflow with a reserved key such as `__proto__` directly to the REST API, so the write lands on `Object.prototype` in the main n8n process and affects every later request. The advisory covers this prototype pollution flaw, which can lead to denial of service.

Mitigation

Fixed in n8n versions 2.37.7 and 2.38.2; upgrade to one of these or later. If upgrading is not immediately possible, restrict instance access to fully trusted users, remove or leave unconfigured the `N8N_INSTANCE_AI_MODEL*` environment variables, and restart the n8n process to clear in-memory pollution if an attack is suspected. These workarounds do not fully remediate the risk and are short-term measures only.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• n8nnpmDeclares an LLM dependency

Related items

• MediumCVE-2026-122160: myshell-ai AIlice HuggingFace Model Wrapper untrusted model loadingSimilar attack · NVD/CVE Database
• MediumCVE-2026-122159: Edge0-AI Audio8_TTS path traversal via slow_decode_models argumentSimilar attack · NVD/CVE Database
• MediumCVE-2026-122235: Jan workspace guard bypass allows file writes outside workspace via symlinksSimilar attack · NVD/CVE Database
• HighCVE-2026-122135: Mistral Vibe remote code execution via repository gpg.program settingSimilar attack · NVD/CVE Database
• HighCVE-2026-122134: Mistral Vibe remote code execution through malicious Git filter driversSimilar attack · NVD/CVE Database