{"data":{"id":"535339f8-3df0-4507-839e-d14435a1cd73","title":"GHSA-q5f4-99jv-pgg5: n8n has Prototype Pollution in XML Webhook Body Parser that Leads to RCE","summary":"A flaw in the `xml2js` library, used by n8n's webhook handler to parse XML request bodies, allows prototype pollution through a crafted XML payload. An authenticated user with permission to create or modify workflows can chain this with the Git node's SSH operations to achieve remote code execution on the n8n host.","solution":"The issue is fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1; users should upgrade to one of these or later. If upgrading is not immediately possible, limit workflow creation and editing permissions to fully trusted users only, noting this is a short-term measure that does not fully remediate the risk.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-q5f4-99jv-pgg5","publishedAt":"2026-04-29T21:25:02.000Z","cveId":"CVE-2026-42231","cweIds":null,"cvssScore":null,"cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["n8n@>= 2.17.0, < 2.17.4 (fixed: 2.17.4)","n8n@>= 2.18.0, < 2.18.1 (fixed: 2.18.1)","n8n@< 1.123.32 (fixed: 1.123.32)"],"affectedPackageNames":["n8n"],"affectedPackageRefs":["npm:n8n"],"affectedVendors":[],"affectedVendorsRaw":["n8n"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00851,"epssCheckedAt":"2026-11-09T12:10:45.895Z","kevDateAdded":null,"advisoryAliases":["GHSA-q5f4-99jv-pgg5"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-04-29T21:25:02.000Z","fixReleasedAt":"2026-04-22T06:25:44.105Z","daysToFix":-7,"fixCheckedAt":"2026-10-29T21:37:11.047Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.7,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"n8n","fixedVersion":"1.123.32","matchedVersion":"1.123.32","fixReleasedAt":"2026-04-22T06:25:44.105Z","daysToFix":-7,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:37:10.900Z"},{"ecosystem":"npm","name":"n8n","fixedVersion":"2.17.4","matchedVersion":"2.17.4","fixReleasedAt":"2026-04-22T07:16:24.418Z","daysToFix":-7,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:37:10.900Z"},{"ecosystem":"npm","name":"n8n","fixedVersion":"2.18.1","matchedVersion":"2.18.1","fixReleasedAt":"2026-04-22T06:58:17.570Z","daysToFix":-7,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:37:10.900Z"}]}}