Prototype pollution in n8n - CVE-2026-42231
Published: April 23, 2026
Vulnerability identifier: #VU127216
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-42231
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to prototype pollution in the xml2js library used by the webhook body parser when parsing a crafted XML request body. A remote attacker can send a crafted XML payload and chain the resulting prototype pollution with the Git node's SSH operations to execute arbitrary code.
Exploitation requires the ability to create or modify workflows.
Affected software
n8n
How to mitigate CVE-2026-42231
Install security update from vendor's website.
n8n - addressed in versions 1.123.32, 2.17.4, 2.18.1