SB2026061241 - Multiple vulnerabilities in n8n

Description

This security bulletin contains information about 4 vulnerabilities.

1) Input validation error (CVE-ID: CVE-2026-54314)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the Compression node Decompress operation when processing attacker-supplied ZIP archives through a public webhook workflow. A remote attacker can send a small crafted compressed archive to cause a denial of service.

The issue can exhaust memory and terminate the process, disrupting all workflows running in the same instance.

2) SQL injection (CVE-ID: CVE-2026-54313)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to overwrite documents with attacker-controlled content.

The vulnerability exists due to improper neutralization of special elements in the MongoDB node Find And Replace operation when processing a user-supplied query filter. A remote user can supply a malicious filter value to overwrite documents with attacker-controlled content.

Exploitation requires workflow edit access.

3) Prototype pollution (CVE-ID: CVE-2026-54312)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improperly controlled modification of object prototype attributes in the Microsoft SQL node when processing a crafted table parameter. A remote user can supply a crafted table parameter to cause a denial of service.

The issue can pollute Object.prototype process-wide for the lifetime of the server process, causing application-wide validation failures until the service is restarted.

4) Cross-site scripting (CVE-ID: CVE-2026-54303)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear

The vulnerability allows a remote user to execute arbitrary script in the victim's browser in the n8n origin.

The vulnerability exists due to cross-site scripting in the Meta and Microsoft Teams trigger webhook verification endpoints when handling crafted query parameters. A remote user can send a specially crafted URL to a victim to execute arbitrary script in the victim's browser in the n8n origin.

User interaction is required, and the victim must be logged in and visit a crafted URL.

Remediation

Install update from vendor's website.

References

• https://github.com/n8n-io/n8n/security/advisories/GHSA-jqpw-qww5-cj4c
• https://github.com/n8n-io/n8n/security/advisories/GHSA-jpq7-226w-6cxx
• https://github.com/n8n-io/n8n/security/advisories/GHSA-x6p3-m6h9-fx7r
• https://github.com/n8n-io/n8n/security/advisories/GHSA-h86q-fx34-gfjr