Prototype pollution in n8n - CVE-2026-44791
Published: May 13, 2026
Vulnerability identifier: #VU131356
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-44791
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to prototype pollution in the XML node when creating or modifying workflows. A remote user can bypass the existing patch and combine the XML node with other nodes to execute arbitrary code.
Exploitation requires permission to create or modify workflows.
Affected software
n8n
How to mitigate CVE-2026-44791
Install security update from vendor's website.
n8n - addressed in versions 1.123.43, 2.20.7, 2.22.1