Prototype pollution in n8n - #VU141003
Published: August 5, 2026
Vulnerability identifier: #VU141003
CSH Severity: Low
CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escape the sandbox and access the host's global object.
The vulnerability exists due to improper control of prototype modification in the JavaScript Code node VM sandbox when executing Code node workflows. A remote user can pollute sandbox Function.prototype to recover a reference to the host's globalThis and access the host's global object.
Exploitation requires the ability to create and execute workflows, and the full exploit chain depends on specific modules being available as allowlisted imports in the deployment configuration.
Affected software
n8n
Remediation
Install security update from vendor's website.
n8n - addressed in versions 1.123.69, 2.33.4, 2.34.1