GHSA-hx4h-vr3m-45vh: n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service
- Identifier
- GHSA-hx4h-vr3m-45vh
- Published
- Record updated
- Affected
- n8n >= 2.0.0-rc.0, < 2.31.5, fixed in 2.31.5, released July 22, 2026, on the day of disclosure
- n8n >= 2.32.0, < 2.32.1, fixed in 2.32.1, released July 22, 2026, on the day of disclosure
- n8n < 1.123.67, fixed in 1.123.67, released July 22, 2026, on the day of disclosure
Summary
An authenticated user who can create or edit a workflow expression can abuse array-element access in n8n's VM expression engine to reach a host built-in and pollute its prototype in the main n8n process, causing a denial of service. Both self-hosted and cloud instances running the VM expression engine are affected.
Mitigation
Fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1; upgrade to one of these or later. If upgrading is not immediately possible: restrict n8n instance access to fully trusted users only, and disable the VM expression engine if an alternative is available for the deployment. These workarounds do not fully remediate the risk and are short-term measures only.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- n8nnpmLLM dependency since 2026-02-10
Related items
- MediumCVE-2026-127202: MLflow path traversal through model_id in the log outputs APISimilar attack · NVD/CVE Database
- LowAI chatbots are recommending fake retail websites, study findsSimilar attack · The Verge (AI)
- MediumPalo Alto tracks a massive Chinese AI attack that sadly lives up to industry fearsSimilar attack · CSO Online
- MediumAttackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society SectorsSimilar attack · Palo Alto Unit 42
- MediumCVE-2026-126994: braindecode model config deserialization flaw via activation argumentSimilar attack · NVD/CVE Database