EUVD-2026-38459
GHSA-jpq7-226w-6cxx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Workflow edit permission maps to PR:L; S:C reflects MongoDB as a separately impacted system; C:N and A:N apply as only document integrity is compromised.
Primary rating from Vendor (https://github.com/n8n-io/n8n).
CVSS VectorVendor: https://github.com/n8n-io/n8n
Lifecycle Timeline
3DescriptionCVE.org
Impact
An authenticated user with workflow edit access could supply a malicious filter value in the MongoDB node's Find And Replace operation. The value was not validated before being passed to MongoDB as a query filter, allowing unintended documents to be matched and overwritten with attacker-controlled content.
Patches
The issue has been fixed in n8n version 2.24.0. Users should upgrade to this version or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Limit workflow creation and editing permissions to fully trusted users only.
- Disable the MongoDB node by adding
n8n-nodes-base.mongoDbto theNODES_EXCLUDEenvironment variable.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
AnalysisAI
NoSQL injection in n8n's MongoDB node (all versions prior to 2.24.0) enables authenticated users with workflow edit access to supply malicious filter values in the Find And Replace operation, causing MongoDB to match and overwrite documents far beyond the attacker's intended scope. The root cause is unsanitized user input being passed directly to MongoDB as a query filter without validation, and the scope change (S:C in CVSS) means the impact propagates from n8n itself into the connected MongoDB database layer. No public exploit has been identified at time of analysis, and exploitation is bounded by the requirement for a valid n8n account with workflow editing permissions.
Technical ContextAI
n8n is an open-source workflow automation platform distributed as an npm package (pkg:npm/n8n). Its built-in MongoDB integration node exposes a 'Find And Replace' operation that accepts user-supplied filter criteria to locate documents before overwriting them. The vulnerability occurs because filter values entered in the workflow editor are not validated or sanitized before being forwarded to MongoDB as raw query filter objects, allowing injection of MongoDB query operators (such as $where, $regex, or operator-based predicates) that can match a much broader document set than intended. The advisory and GHSA title both describe this as 'NoSQL Injection,' making CWE-943 (Improper Neutralization of Special Elements in Data Query Logic) a more precise root-cause classification than the assigned CWE-89 (SQL Injection), which is technically scoped to relational SQL syntax - this discrepancy appears to be a tooling classification artifact. The 'SQLi' tag attached to this CVE should be interpreted in the broader injection family context.
RemediationAI
The primary remediation is to upgrade n8n to version 2.24.0 or later, which contains the vendor-confirmed fix per the security advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-jpq7-226w-6cxx. If an immediate upgrade is not feasible, two temporary mitigations are available, each with trade-offs: first, restrict workflow creation and editing permissions to fully trusted administrators only - this reduces the attack surface without disrupting MongoDB-dependent workflows, but limits collaborative use of the platform and may not be practical in environments with large user bases. Second, disable the MongoDB node entirely by adding 'n8n-nodes-base.mongoDb' to the NODES_EXCLUDE environment variable - this eliminates the vulnerable code path completely but will break all existing MongoDB-backed workflows. The vendor explicitly states that neither workaround fully remediates the risk and both should be treated as short-term measures only until upgrade to 2.24.0 is completed.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today