n8n: Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the xml2js library used to parse XML…
n8n
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-42231
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 4, 2026
- Source last modified
- June 17, 2026
Description
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the xml2js library used to parse XML request bodies in n8n's webhook handler allowed prototype pollution via a crafted XML payload. An authenticated user with permission to create or modify workflows could exploit this to pollute the JavaScript object prototype and, by chaining the pollution with the Git node's SSH operations, achieve remote code execution on the n8n host. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.
Description quoted from the NVD record.
Who is affected
n8n is a tool that lets your organization connect apps and automate routine tasks. This flaw affects n8n versions before 1.123.32, 2.17.4 and 2.18.1. It sits in the part of n8n that receives incoming web requests from other services. Someone who already has an n8n account with permission to create or change workflows could send specially crafted data. By combining it with a building block that connects to code storage services, they could run their own commands on the computer that hosts n8n. This flaw is rated High.
What to do
- If someone in your organization installed n8n and runs it, ask that person to check which version is in use.
- If an IT provider or vendor runs n8n for your organization, send them this advisory and ask when the update will be done.
- Update n8n to version
1.123.32,2.17.4or2.18.1, or a later release, picking the one that matches the version series you already use. - Once the update is in place, check that the version number shown in n8n is one of these fixed versions or newer.
Analysis written from the source record as of June 17, 2026 and reviewed before publishing.