CVE-2026-85167
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Sep 3, 2026
CISA due date
—
The record
n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, which build their JSON query by interpolating expression values directly into the query string before parsing. A value containing quote and brace characters can close the intended field and introduce new query operators, turning an intended single-document lookup into a full-collection read.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-106119 LangChain is a framework for building LLM-powered applications. CWE-943
- CVE-2026-105799 LangChain is a framework for building LLM-powered applications. CWE-943
- CVE-2026-88029 Improper neutralization of special elements in data query logic in the GridFS component… CWE-943
- CVE-2026-88030 Improper neutralization of special elements in data query logic in the GridFS component… CWE-943
- CVE-2026-63138 Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can… CWE-943
- CVE-2026-79483 FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in… CWE-943
- CVE-2026-78691 Improper Neutralization of Special Elements in Data Query Logic vulnerability in… CWE-943
- CVE-2026-77846 Improper Neutralization of Special Elements in Data Query Logic vulnerability in… CWE-943