Improper Neutralization of Special Elements in Data Query Logic in n8n - #VU140990
Published: August 5, 2026
Vulnerability identifier: #VU140990
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-943
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to modify the behavior of database operations and affect the confidentiality, integrity, or availability of downstream systems.
The vulnerability exists due to improper neutralization of special elements in the MongoDB node Query parameter in Find, Delete, and Aggregate operations when processing expressions resolved into JSON queries. A remote attacker can supply data containing MongoDB operators such as $ne or $where to modify the intended query and affect the confidentiality, integrity, or availability of downstream systems.
Exploitation requires a workflow that embeds externally controlled data into the Query field through expression interpolation.
Affected software
n8n
Remediation
Install security update from vendor's website.
n8n - addressed in versions 1.123.69, 2.33.4, 2.34.1