CVE-2026-42231: n8n: Prototype Pollution in XML Webhook Body Parser Leads to RCE
Impact A flaw in the xml2js library used to parse XML request bodies in n8n's webhook handler allowed prototype pollution via a crafted XML payload. An authenticated user with permission to create or modify workflows could exploit this to pollute the JavaScript object prototype and, by chaining the pollution with the Git node's SSH operations, achieve remote code execution on the n8n host.
Patches The issue has been fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Limit workflow creation and editing permissions to fully trusted users only.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Other sources
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the xml2js library used to parse XML request bodies in n8n's webhook handler allowed prototype pollution via a crafted XML payload. An authenticated user with permission to create or modify workflows could exploit this to pollute the JavaScript object prototype and, by chaining the pollution with the Git node's SSH operations, achieve remote code execution on the n8n host. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42231?
CVE-2026-42231 is considered a moderate severity vulnerability, allowing for prototype pollution in the affected n8n versions.
How do I fix CVE-2026-42231?
To fix CVE-2026-42231, update n8n to version 2.17.4, 2.18.1, or a later version that includes the patch.
What versions of n8n are affected by CVE-2026-42231?
CVE-2026-42231 affects n8n versions between 2.17.0 and 2.17.4, as well as versions between 2.18.0 and 2.18.1, and all versions up to 1.123.32.
Who can exploit CVE-2026-42231?
An authenticated user with permissions to create or modify workflows can exploit CVE-2026-42231.
What is prototype pollution in the context of CVE-2026-42231?
In the context of CVE-2026-42231, prototype pollution refers to the ability to modify the JavaScript object prototype, which can lead to potential security risks or application disruption.