EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Lobsters·Aug 16·5 min read
CVE-2026-33696: From a Schema Name to RCE in n8n
TL;DR
A security vulnerability (CVE-2026-33696) was discovered in n8n, allowing remote code execution (RCE) through user-controlled schema names. This flaw arises from improper handling of user-supplied strings as object keys.
✦ Why It Matters
Review and sanitize user inputs in your applications to prevent similar vulnerabilities.
Key Takeaways
- Audit your n8n nodes for similar vulnerabilities.
- Implement input validation to prevent prototype pollution.
- Update n8n to the latest version to mitigate risks.
- Monitor for unusual activity that may indicate exploitation.
How It Works
The vulnerability exploits the use of user-defined schema names as keys in an object. By setting the schema name to '__proto__', an attacker can manipulate the Object.prototype, allowing them to add or modify properties globally.
This leads to remote code execution when the polluted properties are used in subsequent operations, such as spawning child processes.