CVE-2026-42231

high

Published 2026-05-04 · Modified 2026-05-08

CVSS v3

8.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS v2

—

VIR risk

8.8

Description

n8n has Prototype Pollution in XML Webhook Body Parser that Leads to RCE

Exploit likelihood

92%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

vendor Authored 2026-05-27

Vendor advisory: security-advisories@github.com — https://github.com/n8n-io/n8n/security/advisories/GHSA-q5f4-99jv-pgg5

Ecosystem	Package	Vulnerable	Fixed
npm	n8n	`<1.123.32`	`1.123.32`
npm	n8n	`>=2.18.0,<2.18.1`	`2.18.1`
npm	n8n	`>=2.17.0,<2.17.4`	`2.17.4`
NPM	n8n	`>= 2.17.0, < 2.17.4`	`2.17.4`
NPM	n8n	`>= 2.18.0, < 2.18.1`	`2.18.1`
NPM	n8n	`< 1.123.32`	`1.123.32`

Vendor	Product	Versions	Fixed
n8n	n8n	`{"endExcluding":"1.123.32"}`	`1.123.32`
n8n	n8n	`2.18.0`

CWE-1321

Verify integrity in audit chain (admin only). AS-IS.