DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-9CMH-XCQM-5HQR: GHSA-9cmh-xcqm-5hqr: Cross-Tenant Module-Cache Poisoning in n8n JS Task Runner

#security #cve #cybersecurity #ghsa

GHSA-9cmh-xcqm-5hqr: Cross-Tenant Module-Cache Poisoning in n8n JS Task Runner

Vulnerability ID: GHSA-9CMH-XCQM-5HQR
CVSS Score: 5.8
Published: 2026-07-22

A module-cache poisoning vulnerability exists in the n8n JavaScript task runner. In multi-tenant or multi-user n8n deployments, custom code executed inside Code nodes shares a single Node.js process and memory space. If custom module loading is enabled via configuration, an authorized user can dynamically patch (monkey-patch) globally cached modules. Subsequent executions of workflows by other tenants or users that load the same module will receive the poisoned reference, resulting in cross-tenant data exposure, credential hijacking, or integrity compromise.

TL;DR

A shared Node.js process and module cache in n8n's JavaScript task runner allows low-privileged users to dynamically hijack ('monkey-patch') globally imported Node.js and npm modules. This permits cross-tenant data theft and unauthorized execution boundaries breach within multi-user n8n environments.

Technical Details

  • CWE ID: CWE-20
  • Attack Vector: Network (AV:N)
  • CVSS Score: 5.8
  • Exploit Status: No Public PoC
  • Impact: Cross-Tenant Information Disclosure / Integrity Compromise
  • Privileges Required: Low (PR:L)

Affected Systems

  • n8n Multi-user Deployments
  • n8n JavaScript Task Runner Process

Mitigation Strategies

  • Upgrade n8n to version 1.123.67, 2.31.5, or 2.32.1 depending on the deployment branch.
  • Disable built-in and external module loading by unsetting the relevant environment parameters in the configuration.
  • Deploy task-runner worker processes in isolated environments such as project-specific containers.

Remediation Steps:

  1. Inspect the running deployment manifest to determine the active version of the n8n application.
  2. Modify the container image tag or package.json dependency reference to target version 1.123.67, 2.31.5, or 2.32.1.
  3. If patching is not possible immediately, open the system environment configuration.
  4. Unset or clear the values of NODE_FUNCTION_ALLOW_BUILTIN and NODE_FUNCTION_ALLOW_EXTERNAL.
  5. Restart all running n8n core and worker containers to flush cached modules and enforce runtime changes.

Read the full report for GHSA-9CMH-XCQM-5HQR on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)