Skip to content

CVE-2026-42232 - n8n XML node prototype pollution RCE

n8n’s XML node can allow global JavaScript prototype pollution when an authenticated workflow author supplies crafted XML. The polluted prototype can then be chained with other nodes that act on polluted properties, producing remote code execution in vulnerable n8n hosts.

The highest-risk deployments let semi-trusted users create or edit workflows and run XML-processing workflows in the same environment as host-interacting nodes such as Git, SSH, command, file-system, code, or credentialed integration nodes.

Affected versions

  • Vulnerable: n8n <1.123.32
  • Vulnerable: n8n >=2.17.0, <2.17.4
  • Vulnerable: n8n >=2.18.0, <2.18.1
  • Fixed: n8n 1.123.32, 2.17.4, 2.18.1, or later on the selected release line

Indicator-of-exposure

  • The repository builds, deploys, or pins the n8n server/runtime.
  • The resolved runtime is in one of the affected version ranges through npm, container images, Helm charts, compose files, IaC, or release manifests.
  • Authenticated users outside the core admin/operator group can create or modify workflows.
  • XML node usage is enabled, or NODES_EXCLUDE does not exclude n8n-nodes-base.xml.
  • Workflows can combine XML processing with nodes that access host resources, credentials, source control, SSH, shell execution, or external systems.

Quick checks:

rg -n "n8n|N8N_VERSION|n8nio/n8n|NODES_EXCLUDE|n8n-nodes-base.xml|XML|xml" .
npm ls n8n
pnpm why n8n
yarn why n8n
docker image ls | rg 'n8n|n8nio'

Remediation strategy

  • Upgrade all controlled n8n runtimes to 1.123.32+, 2.17.4+, or 2.18.1+.
  • Pin explicit patched image tags or digests instead of floating vulnerable tags.
  • If upgrade is delayed, temporarily restrict workflow creation and editing to fully trusted users and disable the XML node by adding n8n-nodes-base.xml to NODES_EXCLUDE.
  • Review workflow exports and production workflows for XML node chains that feed host-interacting nodes.
  • Rotate credentials available to vulnerable workflows if suspicious workflow edits, XML payloads, or execution traces are found.

The prompt 

Model context: this prompt was generated by GPT 5.5 Extra High reasoning.

You are remediating CVE-2026-42232 (n8n XML node prototype pollution leading to
RCE). Produce exactly one output:

- A reviewer-ready PR/change request that upgrades n8n, preserves the intended
  release line, adds regression/deployment checks, and documents operator
  containment, or
- TRIAGE.md if this repository does not own an affected n8n runtime or safe
  patch path.

## Rules

- Scope only CVE-2026-42232.
- Distinguish n8n server/runtime deployments from n8n API clients, workflow
  exports, SDK wrappers, or documentation.
- Do not execute exploit payloads or live workflow chains to prove RCE.
- Do not print, snapshot, or commit n8n credentials, webhook tokens, SSH keys,
  Git credentials, workflow secrets, cookies, execution data, or environment
  secrets.
- Do not auto-merge.

## Steps

1. Inventory every n8n runtime reference controlled by the repository:
   package manifests, lockfiles, Dockerfiles, compose files, Helm values,
   Kubernetes manifests, Terraform, Ansible, release scripts, SBOMs, generated
   dependency manifests, workflow bundles, and runbooks.
2. Determine whether any deployable n8n runtime resolves to:
   - `n8n <1.123.32`;
   - `n8n >=2.17.0, <2.17.4`;
   - `n8n >=2.18.0, <2.18.1`.
3. If the repository only stores workflow exports or talks to an externally
   owned n8n instance, stop with `TRIAGE.md` naming the owner, evidence, and
   required patched versions.
4. Upgrade vulnerable runtimes on their existing release line:
   - `1.x` to `1.123.32+`;
   - `2.17.x` to `2.17.4+`;
   - `2.18.x` to `2.18.1+`;
   - floating image tags to explicit patched tags or digests.
5. Regenerate lockfiles, rendered deploy manifests, container metadata, SBOMs,
   generated dependency reports, and image digests as appropriate for this repo.
6. Search configuration and workflow assets for XML node exposure:
   - `n8n-nodes-base.xml`;
   - XML nodes or XML parsing;
   - `NODES_EXCLUDE`;
   - workflow author/editor roles;
   - Git, SSH, command, code, file-system, or other host-interacting nodes near
     XML-processing paths.
7. Add or update a test, policy check, or deployment-render assertion that proves
   the resolved n8n version is patched. If this repo manages node exclusions,
   also test that emergency `NODES_EXCLUDE` configuration renders correctly when
   enabled.
8. Add a PR body section named `CVE-2026-42232 operator actions` that states:
   - which n8n release line was upgraded;
   - whether XML node usage exists;
   - whether workflow authoring is limited to trusted users during rollout;
   - whether `NODES_EXCLUDE=n8n-nodes-base.xml` is needed as temporary
     containment;
   - whether credential rotation or incident review is required.
9. If immediate upgrade is blocked, add temporary containment where this repo
   controls it:
   - restrict workflow creation and editing to trusted administrators;
   - disable the XML node with `NODES_EXCLUDE`;
   - reduce n8n worker privileges and network/file-system reach;
   - document residual risk because containment does not fully remediate.
10. Run available validation: package-manager install check, lockfile integrity,
    unit tests, workflow import/export checks, lint/typecheck, image build,
    deploy rendering, and dependency/security scans.
11. Use PR title:
    `fix(sec): remediate CVE-2026-42232 in n8n`.

## Stop conditions

- The repository does not deploy or package n8n.
- The n8n runtime is owned by another team or vendor and cannot be patched here.
- A fixed version cannot be consumed without a larger n8n migration.
- Verifying exposure would require running exploit-like XML payloads or
  host-command workflow chains.
- Validation fails for unrelated pre-existing reasons; document those failures
  instead of broadening scope.

Verification - what the reviewer looks for

  • No deployable n8n runtime remains below 1.123.32, in 2.17.0 through 2.17.3, or on 2.18.0.
  • Lockfiles, image tags/digests, SBOMs, and rendered deployment manifests all resolve to a patched release.
  • XML node exposure, workflow authoring permissions, and temporary NODES_EXCLUDE containment are explicitly addressed.
  • The change avoids exploit execution and does not expose workflow secrets or credentials in logs.
  • Tests, builds, deployment rendering, and dependency scans pass or unrelated failures are documented.

Watch for

  • Repositories that pin n8n in multiple places, especially chart values plus Docker images plus lockfiles.
  • Treating NODES_EXCLUDE as sufficient remediation instead of a short-term control.
  • Workflow authors with broad edit rights in otherwise “internal” instances.
  • Workflow fixtures or exports that keep XML node chains hidden outside normal dependency scanning.

References