CyberRota Analysis
AI-GeneratedThe vulnerability affects n8n versions prior to 1.123.69, 2.33.4, and 2.34.1, specifically within the MongoDB node's Find, Delete, and Aggregate operations, which improperly handle the Query parameter. This flaw allows attackers to perform NoSQL injection, potentially leading to unauthorized access or manipulation of the entire database, including full-collection disclosure or deletion. Organizations using affected versions of n8n with MongoDB should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability in the MongoDB node's Find, Delete, and Aggregate operations, which parse the Query parameter as JSON after expression resolution without sanitizing MongoDB operators. An attacker who can influence the resolved query (e.g., via externally-controlled data) can inject operators such as $ne or $where, turning an intended single-document lookup into full-collection disclosure, full-collection deletion, or other operations on the database server.
Related CVEs
Other vulnerabilities affecting the same vendor(s)