Prototype pollution in n8n - CVE-2026-42232
Published: April 23, 2026
Vulnerability identifier: #VU127215
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-42232
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to prototype pollution in the XML Node when creating or modifying workflows containing XML node data. A remote user can create or modify a workflow to trigger global prototype pollution and execute arbitrary code.
Exploitation requires permission to create or modify workflows and code execution occurs when combined with other nodes exploiting the prototype pollution.
Affected software
n8n
How to mitigate CVE-2026-42232
Install security update from vendor's website.
n8n - addressed in versions 1.123.32, 2.17.4, 2.18.1