CVE-2026-42231
Undergoing Analysis Undergoing Analysis - In Progress
Prototype Pollution in n8n Leading to RCE

Publication date: 2026-05-04

Last updated on: 2026-05-06

Assigner: GitHub, Inc.

Description
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the xml2js library used to parse XML request bodies in n8n's webhook handler allowed prototype pollution via a crafted XML payload. An authenticated user with permission to create or modify workflows could exploit this to pollute the JavaScript object prototype and, by chaining the pollution with the Git node's SSH operations, achieve remote code execution on the n8n host. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-04
Last Modified
2026-05-06
Generated
2026-06-16
AI Q&A
2026-05-05
EPSS Evaluated
2026-06-14
NVD
CVE-2026-42231
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
n8n n8n to 1.123.32 (exc)
n8n n8n 2.18.0
n8n n8n From 2.17.0 (inc) to 2.17.4 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the n8n workflow automation platform due to a flaw in the xml2js library used to parse XML request bodies in n8n's webhook handler. Specifically, an authenticated user with permission to create or modify workflows can send a crafted XML payload that causes prototype pollution in JavaScript objects. By exploiting this prototype pollution and chaining it with the Git node's SSH operations, the attacker can achieve remote code execution on the n8n host.

Impact Analysis

The vulnerability can have severe impacts because it allows an authenticated user with workflow modification permissions to execute arbitrary code remotely on the n8n host. This could lead to full system compromise, unauthorized access to sensitive data, disruption of services, and potential further exploitation within the affected environment.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade n8n to one of the patched versions: 1.123.32, 2.17.4, or 2.18.1.

Ensure that only trusted authenticated users have permission to create or modify workflows, as exploitation requires such permissions.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-42231. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart