GHSA-q5f4-99jv-pgg5: n8n has Prototype Pollution in XML Webhook Body Parser that Leads to RCE

Summary

A flaw in the `xml2js` library, used by n8n's webhook handler to parse XML request bodies, allows prototype pollution through a crafted XML payload. An authenticated user with permission to create or modify workflows can chain this with the Git node's SSH operations to achieve remote code execution on the n8n host.

Mitigation

The issue is fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1; users should upgrade to one of these or later. If upgrading is not immediately possible, limit workflow creation and editing permissions to fully trusted users only, noting this is a short-term measure that does not fully remediate the risk.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• n8nnpmLLM dependency since 2026-02-10

Related items

• MediumRecent AI agent experiments reveal a risky future of machine 'teamwork' inside corporationsSimilar attack · CNBC Technology
• MediumClaude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubSimilar attack · The Hacker News
• MediumCVE-2026-118046: JS Help Desk plugin stored DOM-based cross-site scripting via jsticket_messageSimilar attack · NVD/CVE Database
• MediumARTEX abuse expands as cybercriminals target financial sectorSimilar attack · Microsoft Security Blog
• MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database