CVE-2026-54313: n8n: NoSQL Injection in MongoDB Node Find And Replace Operation

June 16, 2026

An authenticated user with workflow edit access could supply a malicious filter value in the MongoDB node’s Find And Replace operation. The value was not validated before being passed to MongoDB as a query filter, allowing unintended documents to be matched and overwritten with attacker-controlled content.

References

github.com/advisories/GHSA-jpq7-226w-6cxx
github.com/n8n-io/n8n/security/advisories/GHSA-jpq7-226w-6cxx
nvd.nist.gov/vuln/detail/CVE-2026-54313

Code Behaviors & Features

Detect and mitigate CVE-2026-54313 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →