CVE-2026-54306

n8n (open-source workflow automation) contains a prototype pollution vulnerability prior to versions 2.25.7 and 2.26.2. A crafted payload in a public webhook could inject attacker-controlled fields into workflow data during internal object copying, allowing downstream nodes to surface and consume...

NPM: n8n: Prototype Pollution enables confused-deputy execution via public webhooks

NPM: n8n: Prototype Pollution enables confused-deputy execution via public webhooks vulnerability discovered by ? in WordPress Npm n8n versions 2.25.7...

NPM: n8n: Missing Token Validation on Microsoft Agent 365 Trigger and Stripe Nodes

NPM: n8n: Missing Token Validation on Microsoft Agent 365 Trigger and Stripe Nodes vulnerability discovered by ? in WordPress Npm n8n versions 2.25.7...

NPM: n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes

NPM: n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes vulnerability discovered by ? in WordPress Npm n8n versions 2.25.7...