GHSA-ppgm-m8rg-4wqv: 
JavaScript vulnerability analysis and mitigation

Impact

The workflow auto-fixer (n8n_autofix_workflow, including preview mode) and connection handling in n8n_update_partial_workflow (including validateOnly) used parameter keys, node names and connection type names from the workflow or the tool call as keys on plain JavaScript objects. A workflow or call using reserved names could modify Object.prototype in the server process.

• stdio and single-tenant HTTP mode: the change only affects the caller's own server process until it restarts.
• Multi-tenant HTTP mode (ENABLE_MULTI_TENANT=true): one process serves every tenant, so the change persists until restart and affects other tenants' requests. Their workflow writes can be rejected, and data from their connection updates can end up in shared process state. No code execution was demonstrated.

Affected versions

n8n-mcp 2.98.0 and earlier.

Patched versions

2.98.1. The fix rejects reserved names in these paths and reads these maps by own keys only.

Workarounds

• Run n8n-mcp in stdio mode, or as one process per tenant, instead of multi-tenant HTTP mode.
• Restrict who can reach the HTTP endpoint and who can edit workflows on the connected n8n instances.
• Disable the affected tools with DISABLED_TOOLS=n8n_autofix_workflow,n8n_update_partial_workflow.

Credit

Reported by Zachariah Mithani (@zachariah-mithani, AploSec).