Answer in brief
CVE-2026-72769 records a Unknown severity vulnerability in n8n before 1.123.67 Prototype Pollution via VM Expression Engine. The current sources do not mark it as known exploited. The current feed maps n8n-io/n8n (generic), n8n-io/n8n (generic), n8n-io/n8n (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps n8n-io/n8n (generic), n8n-io/n8n (generic), n8n-io/n8n (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| n8n-io/n8ngeneric | >=0 <1.123.67 | 1.123.67 |
| n8n-io/n8ngeneric | >=0 <2.32.1 | 2.32.1 |
| n8n-io/n8ngeneric | >=0 <2.31.5 | 2.31.5 |
Published upstream
Aug 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 11, 2026
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able to create or edit a workflow expression can abuse the engine's array-element access to obtain a reference to a host built-in and pollute its prototype in the main n8n process (a sandbox escape), leading to a denial of service. Both self-hosted and cloud instances running the VM expression engine are affected.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-72769 records a Unknown severity vulnerability in n8n before 1.123.67 Prototype Pollution via VM Expression Engine. The current sources do not mark it as known exploited. The current feed maps n8n-io/n8n (generic), n8n-io/n8n (generic), n8n-io/n8n (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps n8n-io/n8n (generic), n8n-io/n8n (generic), n8n-io/n8n (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| n8n-io/n8ngeneric | >=0 <1.123.67 | 1.123.67 |
| n8n-io/n8ngeneric | >=0 <2.32.1 | 2.32.1 |
| n8n-io/n8ngeneric | >=0 <2.31.5 | 2.31.5 |
Published upstream
Aug 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 11, 2026
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able to create or edit a workflow expression can abuse the engine's array-element access to obtain a reference to a host built-in and pollute its prototype in the main n8n process (a sandbox escape), leading to a denial of service. Both self-hosted and cloud instances running the VM expression engine are affected.
Quoted source text, attributed separately from HOL analysis.