n8n: n8n Has an XML Node Prototype Pollution Patch Bypass
n8n
- Severity
- Critical, CVSS 9.9
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Record
- CVE-2026-44791
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 23, 2026
- Source last modified
- October 26, 2026
Description
n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could bypass the patch for CVE-2026-42232 in the XML node. When combined with other nodes, this could lead to RCE on the n8n host. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7.
Description quoted from the NVD record.
Who is affected
Your organization is affected if it uses n8n, a tool that connects different apps and services and runs tasks between them automatically. This flaw affects versions before 1.123.43, 2.22.1 and 2.20.7. It is in the XML building block, the part of a workflow that reads a common data format called XML. Someone who has an account with permission to create or change workflows could get around an earlier fix for this building block. Combined with other building blocks, this could let them run their own commands on the computer that hosts n8n. This flaw is rated Critical.
What to do
- The person who installed or runs n8n for your organization should handle this update.
- If an IT provider or vendor runs n8n for you, send them this advisory and ask when the update will be done.
- Update n8n to one of the fixed versions,
1.123.43,2.22.1or2.20.7, or a later release. - Check the vendor advisory linked on this page to see which of these fixed versions fits the version you run now.
- After updating, check that n8n shows the new version number, so you know the fix is in place.
Analysis written from the source record as of October 26, 2026 and reviewed before publishing.