Skip to content
← Vulnerability catalog
OFFICIAL CVE RECORD6.3 Medium

CVE-2026-85167

n8n before 2.36.2 Query Injection via Elasticsearch Firestore Nodes

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, which build their JSON query by interpolating expression values directly into the query string before parsing. A value containing quote and brace characters can close the intended field and introduce new query operators, turning an intended single-document lookup into a full-collection read.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n8n-io n8n

Default version status: unaffected

  • 2.36.0 to < 2.36.2affected
  • 2.36.2unaffected
pkg:npm/n8n

n8n-io n8n

Default version status: unaffected

  • 0 to < 2.35.4affected
  • 2.35.4unaffected
pkg:npm/n8n

References