{"id":"EUVD-2026-38459","enisaUuid":"b2006c52-79db-3076-868b-b3d05ba9ae72","description":"n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with workflow edit access could supply a malicious filter value in the MongoDB node\u0027s Find And Replace operation. The value was not validated before being passed to MongoDB as a query filter, allowing unintended documents to be matched and overwritten with attacker-controlled content. This vulnerability is fixed in 2.24.0.","datePublished":"Jun 23, 2026, 3:31:07 PM","dateUpdated":"Jun 23, 2026, 5:03:29 PM","baseScore":6.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-jpq7-226w-6cxx\n","aliases":"CVE-2026-54313\nGHSA-jpq7-226w-6cxx\n","assigner":"GitHub_M","epss":0.34,"enisaIdProduct":[{"id":"71a804f8-a5aa-3ccf-a7c7-33131c82b0dd","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"\u003c 2.24.0"}],"enisaIdVendor":[{"id":"807baa29-fbe2-3402-b12b-c9c86aa3c454","vendor":{"name":"n8n-io"}}],"enisaIdVulnerability":[{"id":"187cc7bf-2531-3ea9-b4fc-bd630b24ee27","vulnerability":{"id":"GHSA-jpq7-226w-6cxx","description":"n8n: NoSQL Injection in MongoDB Node Find And Replace Operation","datePublished":"Jun 16, 2026, 6:59:23 PM","dateUpdated":"Jul 20, 2026, 1:39:27 PM","baseScore":0.0,"references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-jpq7-226w-6cxx\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54313\nhttps://github.com/n8n-io/n8n\n","enisa_id":"EUVD-2026-38459\n","aliases":"GHSA-jpq7-226w-6cxx\nCVE-2026-54313\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"4783fb8c-c1ec-36f0-acbf-055c9c8d5edb","vulnerability":{"id":"CVE-2026-54313","description":"n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with workflow edit access could supply a malicious filter value in the MongoDB node\u0027s Find And Replace operation. The value was not validated before being passed to MongoDB as a query filter, allowing unintended documents to be matched and overwritten with attacker-controlled content. This vulnerability is fixed in 2.24.0.","datePublished":"Jun 23, 2026, 3:31:07 PM","dateUpdated":"Jun 23, 2026, 5:03:29 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-jpq7-226w-6cxx\n","enisa_id":"EUVD-2026-38459\n","assigner":"GitHub_M","epss":0.34,"dataProcessed":"Nov 1, 2026, 7:17:24 AM","vulnerabilityProduct":[{"id":"8eb47aad-9841-315f-8947-3140d9e40983","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"\u003c 2.24.0"}],"vulnerabilityVendor":[{"id":"161594c6-6f79-3401-aecb-fd37b39e8453","vendor":{"name":"n8n-io"}}]}}],"enisaIdAdvisory":[{"id":"7bd5ec4e-008f-3e1e-a45a-672b72fce58c","advisory":{"id":"NCSC-2026-0212","description":"Kwetsbaarheden verholpen in n8n workflow automation platform","datePublished":"Jun 29, 2026, 8:02:42 AM","dateUpdated":"Jun 29, 2026, 8:02:42 AM","baseScore":0.0,"references":"","aliases":"CVE-2026-54301\nCVE-2026-54302\nCVE-2026-54304\nCVE-2026-54305\nCVE-2026-54306\nCVE-2026-54307\nCVE-2026-54308\nCVE-2026-54309\nCVE-2026-54310\nCVE-2026-54311\nCVE-2026-54312\nCVE-2026-54313\nCVE-2026-54314\nCVE-2026-54303\n","source":{"id":19,"name":"csaf_ncscnl"},"advisoryProduct":[{"id":"9b0181f2-7f6b-3f30-80cf-cc01cf736196","product":{"name":"n8n","vendor":{"name":"n8n-io"}}}]}}]}