CRITICAL🇵🇱 Wersja polska

CVE-2026-42231

CVSS 9.4v4.0pub. 2026-05-04upd. 2026-05-06

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the xml2js library used to parse XML request bodies in n8n's webhook handler allowed prototype pollution via a crafted XML payload. An authenticated user with permission to create or modify workflows could exploit this to pollute the JavaScript object prototype and, by chaining the pollution with the Git node's SSH operations, achieve remote code execution on the n8n host. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

An attacker with permissions to create or modify workflows sends a crafted XML payload to the n8n webhook handler. The xml2js library parses it in a way that enables prototype pollution — poisoning the prototype of JavaScript objects globally available in the runtime environment. By combining this mechanism with SSH operations performed by the Git node, the attacker is able to achieve arbitrary code execution on the machine hosting n8n.

Impact

An attacker can gain the ability to execute code remotely (RCE) on the n8n server, which in practice means complete takeover of the host and potential access to internal data and systems.

Mitigation & patch

n8n should be updated to version 1.123.32, 2.17.4 or 2.18.1, in which the vulnerability has been patched. Until the update is applied, consider restricting user permissions to create and modify workflows and blocking external access to webhook handlers.

Who is affected

n8n versions earlier than 1.123.32, 2.17.4 and 2.18.1

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X