CVE-2026-33696: From a Schema Name to RCE in n8n | Simon Koeck
simonkoeck.com
n8n uses a user-supplied schema name as a bare object key. Set it to __proto__, pollute the prototype, chain into RCE via the Git node. One request, full shell.