CRITICAL🇵🇱 Wersja polska

CVE-2026-42232

CVSS 9.4v4.0pub. 2026-05-04upd. 2026-05-06

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the XML Node leading to RCE when combined with other nodes exploiting the prototype pollution. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

A user with permissions to create or modify workflows can construct a malicious workflow using the XML Node (XML Node). This node processes input data in a way that allows modification of the JavaScript object prototype at the global level (CWE-1321 — prototype pollution). The polluted prototype can then be exploited by other nodes in the n8n environment to achieve arbitrary server-side code execution.

Impact

An attacker can cause remote code execution (RCE) on the server hosting n8n, which in practice means full takeover of the instance and potential access to data and systems associated with the platform.

Mitigation & patch

n8n should be updated to version 1.123.32, 2.17.4, or 2.18.1, where the vulnerability has been fixed. Additionally, it is recommended to restrict permissions for creating and modifying workflows only to trusted users.

Who is affected

The n8n platform (n8n-io/n8n) in versions prior to 1.123.32, 2.17.4, and 2.18.1

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X