This vulnerability is a prototype pollution flaw in n8n's AI workflow builder. The system merges workflow connections by using node names as keys within an object without preventing reserved identifiers such as __proto__. An authenticated attacker can create a node named __proto__ via the API and then trigger the connect-nodes operation, causing the __proto__ property of the global object prototype to be overwritten. The altered prototype is inherited by newly created objects, changing the behavior of the application and rendering it unstable until the process is restarted.

The flaw impacts n8n installations running any version prior to 1.123.83, 2.x prior to 2.41.4, or 2.42.x prior to 2.42.1. These releases are provided by n8n-io under the product name n8n and are distributed to users who have enabled the AI workflow builder API access.

The CVSS score of 6.0 indicates moderate severity, and no EPSS score is available, so the likelihood of public exploitation cannot be determined. The vulnerability is not included in CISA's KEV catalog. Attack execution requires authenticated API access and the crafting of a node named __proto__ before invoking the connect-nodes action. Successful exploitation disrupts the instance until it is restarted, effectively causing a denial‑of‑service condition for that instance.