CVE-2026-77083

Katalog CVE

CVSS 5.9 · Medium EPSS 0,37%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada n8n. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node execution and recover a reference to the host's globalThis, resulting in a sandbox escape. The full exploit chain additionally depends on specific modules being available as allowlisted imports in the deployment's configuration. The issue is fixed in versions 1.123.69, 2.33.4, and 2.34.1.

Rincian

Terbit di NVD

20 Agustus 2026

Terakhir diubah

1 September 2026

Status NVD

Analyzed

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/n8n-io/n8n/security/advisories/GHSA-c9c6-rq46-h25v mitigasi · advisory vendor
• https://www.vulncheck.com/advisories/n8n-before-code-node-sandbox-escape-via-function.prototype-pollution advisory pihak ketiga