CVE-2026-54313
MEDIUM EPSS 17.3%
Published Jun 23, 20266d ago · Modified Jun 23, 20266d ago
6.5 CVSS 4.0
Published Jun 23, 2026 6d ago
Last Modified Jun 23, 2026 6d ago
Description
n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with workflow edit access could supply a malicious filter value in the MongoDB node's Find And Replace operation. The value was not validated before being passed to MongoDB as a query filter, allowing unintended documents to be matched and overwritten with attacker-controlled content. This vulnerability is fixed in 2.24.0.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
17.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-89 SQL Injection Injection
References 1
- github.com https://github.com/n8n-io/n8n/security/advisories/GHSA-jpq7-226w-6cxx
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.