CVE-2026-110848

— UNSCOREDpublic exploit available

Published 2026-10-14 · Updated 2026-10-16

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named __proto__ through the API and invoke the connect-nodes operation to pollute the global object prototype, disrupting the instance until restart.

Weaknesses

CWE-1321

Public exploit & PoC references

https://github.com/n8n-io/n8n/security/advisories/GHSA-3p2g-2wpm-8h3g

All references

https://github.com/n8n-io/n8n/security/advisories/GHSA-3p2g-2wpm-8h3g
https://www.vulncheck.com/advisories/n8n-before-1.123.83-2.41.4-and-2.42.1-prototype-pollution-via-ai-workflow-builder-connection-merge

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2021-48012PoC
UNSCOREDCVE-2026-101900PoC
UNSCOREDCVE-2026-101902PoC
UNSCOREDCVE-2026-101904PoC
UNSCOREDCVE-2026-101905PoC
UNSCOREDCVE-2026-101908PoC
UNSCOREDCVE-2026-101909PoC
HIGHCVE-2026-102600PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.