CVE-2026-33696
Received Received - Intake
Prototype Pollution in n8n XML and GSuiteAdmin Nodes Enables RCE

Publication date: 2026-03-25

Last updated on: 2026-03-27

Assigner: GitHub, Inc.

Description
n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.27, an authenticated user with permission to create or modify workflows could exploit a prototype pollution vulnerability in the XML and the GSuiteAdmin nodes. By supplying a crafted parameters as part of node configuration, an attacker could write attacker-controlled values onto `Object.prototype`. An attacker could use this prototype pollution to achieve remote code execution on the n8n instance. The issue has been fixed in n8n versions 2.14.1, 2.13.3, and 1.123.27. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only, and/or disable the XML node by adding `n8n-nodes-base.xml` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-25
Last Modified
2026-03-27
Generated
2026-05-07
AI Q&A
2026-03-25
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
n8n n8n to 1.123.27 (exc)
n8n n8n From 2.0.0 (inc) to 2.13.3 (exc)
n8n n8n 2.14.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

CVE-2026-33696 is a critical prototype pollution vulnerability in the n8n workflow automation platform, specifically affecting the XML and GSuiteAdmin nodes in versions prior to 2.14.1, 2.13.3, and 1.123.27.

An authenticated user with permission to create or modify workflows can exploit this vulnerability by supplying specially crafted parameters in the node configuration. This allows the attacker to write malicious values onto JavaScript's Object.prototype.

By polluting the prototype, the attacker can achieve remote code execution (RCE) on the n8n instance, potentially taking full control of the affected system.

The vulnerability has been fixed in the specified versions, and users are advised to upgrade. Temporary mitigations include restricting workflow creation and editing permissions to trusted users and disabling the XML node, but these do not fully eliminate the risk.


How can this vulnerability impact me? :

This vulnerability can have severe impacts on your system if exploited.

  • An attacker with low privileges and no user interaction can remotely execute arbitrary code on your n8n instance.
  • Successful exploitation compromises confidentiality, integrity, and availability of the vulnerable system and any subsequent systems.
  • This could lead to unauthorized access, data manipulation, service disruption, or full system takeover.

What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability immediately, users should upgrade n8n to versions 2.14.1, 2.13.3, or 1.123.27, or later, where the issue has been fixed.

If upgrading is not immediately possible, temporary mitigations include:

  • Limit workflow creation and editing permissions to fully trusted users only.
  • Disable the XML node by adding `n8n-nodes-base.xml` to the `NODES_EXCLUDE` environment variable.

Note that these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.


How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

The vulnerability allows an authenticated user with limited privileges to achieve remote code execution on the n8n instance, which can lead to severe impacts on confidentiality, integrity, and availability of the system.

Such impacts on confidentiality and integrity could potentially lead to non-compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and system integrity.

However, the provided information does not explicitly mention compliance implications or specific effects on regulatory requirements.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart