CVE-2026-54313: n8n: NoSQL Injection in MongoDB Node Find And Replace Operation

June 16, 2026 (updated July 20, 2026)

An authenticated user with workflow edit access could supply a malicious filter value in the MongoDB node’s Find And Replace operation. The value was not validated before being passed to MongoDB as a query filter, allowing unintended documents to be matched and overwritten with attacker-controlled content.

References

github.com/advisories/GHSA-jpq7-226w-6cxx
github.com/n8n-io/n8n/security/advisories/GHSA-jpq7-226w-6cxx
nvd.nist.gov/vuln/detail/CVE-2026-54313

Code Behaviors & Features

Detect and mitigate CVE-2026-54313 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →