GHSA-hx4h-vr3m-45vh: n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service
Summary
n8n, a workflow automation tool, has a vulnerability where authenticated users can exploit the VM expression engine (a system that processes custom code in workflows) through prototype pollution (a technique that modifies how objects behave by changing their base templates) to crash the application, affecting both self-hosted and cloud versions.
Solution / Mitigation
The issue has been fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability. As temporary workarounds if upgrading is not immediately possible, administrators should restrict n8n instance access to fully trusted users only, or disable the VM expression engine if an alternative is available for your deployment. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Classification
Affected Vendors
Affected Packages
Related Issues
CVE-2026-47482: NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause missing release of memory
CVE-2022-29200: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implem
Original source: https://github.com/advisories/GHSA-hx4h-vr3m-45vh
First tracked: July 22, 2026 at 08:01 PM
Classified by LLM (prompt v3) · confidence: 82%