CVE-2026-42231 — CRITICAL (CVSS 10.0) AI Security Vulnerability

Q: What is CVE-2026-42231?

n8n has Prototype Pollution in XML Webhook Body Parser that Leads to RCE

Q: Is CVE-2026-42231 actively exploited?

No confirmed active exploitation of CVE-2026-42231 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-42231?

Update to patched version: n8n 1.123.32.

Q: What is the CVSS score for CVE-2026-42231?

CVE-2026-42231 has a CVSS v3.1 base score of 10.0 (CRITICAL).

## Impact A flaw in the `xml2js` library used to parse XML request bodies in n8n's webhook handler allowed prototype pollution via a crafted XML payload. An authenticated user with permission to create or modify workflows could exploit this to pollute the JavaScript object prototype and, by...

Full CISO analysis pending enrichment.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	< 1.123.32	`1.123.32`
185.6K OpenSSF 6.0 16 dependents Pushed 4d ago 38% patched ~1d to patch Full package profile →

Do you use n8n? You're affected.

Severity & Risk

CVSS 3.1

10.0 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

N/A

Attack Surface

AV Network

AC Low

PR None

UI None

S Changed

C High

I High

A High

Recommended Action

Patch available

Update n8n to version 1.123.32

Compliance Impact

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-42231?

n8n has Prototype Pollution in XML Webhook Body Parser that Leads to RCE

Is CVE-2026-42231 actively exploited?

No confirmed active exploitation of CVE-2026-42231 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-42231?

Update to patched version: n8n 1.123.32.

What is the CVSS score for CVE-2026-42231?

CVE-2026-42231 has a CVSS v3.1 base score of 10.0 (CRITICAL).

Technical Details

NVD Description

## Impact A flaw in the `xml2js` library used to parse XML request bodies in n8n's webhook handler allowed prototype pollution via a crafted XML payload. An authenticated user with permission to create or modify workflows could exploit this to pollute the JavaScript object prototype and, by chaining the pollution with the Git node's SSH operations, achieve remote code execution on the n8n host. ## Patches The issue has been fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Limit workflow creation and editing permissions to fully trusted users only. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.