The vulnerability is a NoSQL injection flaw in n8n, located in the MongoDB node’s Find, Delete, and Aggregate operations. The node parses the Query parameter as JSON after resolving expressions, without sanitizing MongoDB operators. An attacker who can influence the resolved query—such as by providing externally‑controlled data—can inject operators like $ne or $where. This turns a narrowly scoped single‑document lookup into a request that targets an entire collection, potentially exposing all documents, deleting them, or performing other harmful database operations. The weakness is a classic NoSQL injection, identified as CWE‑943, which can compromise confidentiality, integrity, and availability of the database.

n8n by n8n‑io, specifically all releases before 1.123.69, 2.33.4, and 2.34.1. Users running these versions of the automation platform are vulnerable.

The CVSS score of 7.1 indicates a moderate to high severity. Though the EPSS score is not available, the attack path is realistic: through externally‑controlled input that reaches the MongoDB node’s query parameter. The vulnerability is not listed as a known exploited vulnerability in CISA’s KEV catalog at this time, but the potential for full‑collection impact makes it a significant risk for systems that expose the node to untrusted data.