Prototype Pollution in Workflow History Compaction Causes Denial of Service
Résumé
Impact
A workflow's connections object accepts arbitrary keys, and the routine that diffs two sets of connections used those keys directly as object members. A low-privileged user can save a workflow whose connections carry a specially named key; the periodic workflow-history compaction task the...
Résumé IA
Rédigé par une IA externe ; il peut contenir des erreurs. Vérifiez la description d'origine et les références ci-dessous avant d'agir.
低い権限のユーザーが特殊なキーを含むワークフローを保存すると、履歴の整理処理でプロトタイプ汚染が発生し、サービス拒否の状態になります。影響を受けるのはn8nの特定の版で、修正版は2.41.4と2.42.1です。修正版へのアップグレードを推奨します。すぐに更新できない場合は、利用者を信頼できる人だけに絞り、ワークフロー履歴を無効にしてください。
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| npm | n8n |
< 2.41.4 |
>= 2.41.4 |
Description d'origine La description telle que publiée par la source (souvent en anglais).
Impact
A workflow's connections object accepts arbitrary keys, and the routine that diffs two sets of connections used those keys directly as object members. A low-privileged user can save a workflow whose connections carry a specially named key; the periodic workflow-history compaction task then processes it and alters the behaviour of built-in objects for the whole process. The instance then answers logins and writes with server errors.
Patches
This issue has been fixed in n8n version 2.42.1, and 2.41.4. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Disable workflow history by setting
N8N_WORKFLOW_HISTORY_ENABLED=falseif the feature is not required. - Audit existing workflows for nodes with reserved JavaScript property names such as
__proto__,constructor, orprototypein their connections and remove or rename them.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Source: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
Références
- GITHUB_REPO_ADVISORY n8n-io/n8n