CVE-2026-54313 Details
Description
n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with workflow edit access could supply a malicious filter value in the MongoDB node's Find And Replace operation. The value was not validated before being passed to MongoDB as a query filter, allowing unintended documents to be matched and overwritten with attacker-controlled content. This vulnerability is fixed in 2.24.0.
A NoSQL injection vulnerability has been identified in n8n versions prior to 2.24.0. This issue allows an authenticated user with workflow edit access to inject malicious filter values into the MongoDB node's Find and Replace operation. The injected values were not properly validated before being sent to MongoDB as query filters, which could result in unintended documents being matched and overwritten with content controlled by the attacker.
Users are advised to upgrade to n8n version 2.24.0 or later. If an immediate upgrade is not possible, consider limiting workflow creation and editing permissions to trusted users or disabling the MongoDB node by adding 'n8n-nodes-base.mongoDb' to the 'NODES_EXCLUDE' environment variable.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/n8n-io/n8n/security/advisories/GHSA-jpq7-226w-6cxx | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| n8n n8n | < 2.24.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |