CVE-2026-72749

Katalog CVE

CVSS 6.5 · Medium EPSS 0,57%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada n8n. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method path and corrupt a shared global in the main Node.js process. Because that global is used on the request-authentication path, the instance then fails every authenticated request, causing an instance-wide denial of service for all users until the process is restarted.

Rincian

Terbit di NVD

11 Agustus 2026

Terakhir diubah

1 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

0,57% peluang dieksploitasi; lebih tinggi dari 45,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/n8n-io/n8n/security/advisories/GHSA-xwx6-jjhv-84p8 mitigasi · advisory vendor
• https://www.vulncheck.com/advisories/n8n-before-prototype-pollution-via-edit-fields advisory pihak ketiga