Home

Description

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the XML Node leading to RCE when combined with other nodes exploiting the prototype pollution. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

PUBLISHED Reserved 2026-04-25 | Published 2026-05-04 | Updated 2026-05-05 | Assigner GitHub_M




CRITICAL: 9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L

Problem types

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Product status

< 1.123.32
affected

>= 2.17.0, < 2.17.4
affected

>= 2.18.0, < 2.18.1
affected

References

github.com/...io/n8n/security/advisories/GHSA-hqr4-h3xv-9m3r

cve.org (CVE-2026-42232)

nvd.nist.gov (CVE-2026-42232)

Download JSON