n8n MongoDB NoSQL Injection Vulnerability (GHSA-953p-jm2c-8h5j) and Remediation Guide

MongoDB Node NoSQL Injection Vulnerability Summary Vulnerability Overview Vulnerability Name: MongoDB Node NoSQL Injection in Find, Delete, and Aggregate Operations via Unescaped Expression Interpolation Description: The Find, Delete, and Aggregate operations in the MongoDB Node do not JSON-serialize Query parameters after parsing expressions. This allows attackers to inject arbitrary operations (such as or ), leading to full collection data leakage, full collection deletion, or other database operations. Affected Versions Affected Versions: - = 1.123.69 - >= 2.34.1 - >= 2.33.4 Remediation Patch: - Upgrade n8n to version 1.123.69, 2.33.4, or 2.34.1, or higher. Temporary Mitigations: - Restrict access to n8n instances to fully trusted users. - Audit workflows that use the MongoDB Node's Find, Delete, or Aggregate operations to ensure that externally controlled data is not directly embedded into query fields. - Restrict network access to or endpoints that feed data into the MongoDB Node's query fields. - Disable the MongoDB Node (if not needed) by adding to the environment variable. Additional Information Severity: High (7.1/10) CVSS v4 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: Present - Privileges Required: None - User Interaction: None Vulnerable System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None Subsequent System Impact Metrics: - Confidentiality: High - Integrity: High - Availability: High References GitHub Advisory --- Note: Specific POC code or exploit code is not included in this advisory.

Goal Reached Thanks to every supporter — we hit 100%!

n8n MongoDB NoSQL Injection Vulnerability (GHSA-953p-jm2c-8h5j) and Remediation Guide

More from this source