by Kastro
Paper/Archive/CVE-2026-42231

CVE-2026-42231

n8n-io n8n — n8n: Prototype Pollution in XML Webhook Body Parser Leads to RCE

EPSS 0.9%CVSS 9.4
critical.is priorityof 100
40
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 58.2.582 × 2011.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the xml2js library used to parse XML request bodies in n8n's webhook handler allowed prototype pollution via a crafted XML payload. An authenticated user with permission to create or modify workflows could exploit this to pollute the JavaScript object prototype and, by chaining the pollution with the Git node's SSH operations, achieve remote code execution on the n8n host. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

Affected

ProductAffectedFixed inSource
n8n< 1.123.32–CNA
n8n>= 2.17.0, < 2.17.4–CNA
n8n>= 2.18.0, < 2.18.1–CNA

Scores by source

GitHub_M (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/n8n-io/n8n/security/advisories/GHSA-q5f4-99jv-pgg5