CVE-2026-42232
Prototype Pollution to RCE in n8n Workflow Automation
Publication date: 2026-05-04
Last updated on: 2026-05-06
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| n8n | n8n | to 1.123.32 (exc) |
| n8n | n8n | 2.18.0 |
| n8n | n8n | From 2.17.0 (inc) to 2.17.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1321 | The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects the n8n workflow automation platform. Before certain patched versions, an authenticated user with permission to create or modify workflows could exploit a flaw in the XML Node to perform global prototype pollution. Prototype pollution is a type of attack that manipulates the prototype of a base object, potentially altering the behavior of the application. In this case, when combined with other nodes that also exploit prototype pollution, it could lead to remote code execution (RCE), allowing an attacker to execute arbitrary code on the system.
How can this vulnerability impact me? :
The vulnerability can have severe impacts because it allows an authenticated user with workflow creation or modification permissions to achieve remote code execution on the system. This means an attacker could potentially take full control of the affected system, execute arbitrary commands, manipulate workflows, access sensitive data, or disrupt services.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade n8n to one of the patched versions: 1.123.32, 2.17.4, or 2.18.1.
This vulnerability affects versions prior to these releases and involves an authenticated user with permission to create or modify workflows exploiting global prototype pollution via the XML Node.
Applying the update will prevent the prototype pollution and potential remote code execution.