CVE-2026-42232CWE-1321

n8n: XML Node Prototype Pollution to RCE

Critical · published May 4, 2026

CVSS v4.0
9.4
EPSS
1%
Percentile
43.9
In the wild
Unconfirmed
What it is

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the XML Node leading to RCE when combined with other nodes exploiting the prototype pollution. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

The record
Technical detail
CVSS v4.0
9.4 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L
EPSS
0.00529 · 43.9th percentile
Weakness
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published
2026-05-04T18:34Z
EPSS history
Timeline
  • 04 MAY 18:34Z
    n8n: XML Node Prototype Pollution to RCE
    cvelistv5