CVE-2026-42232: n8n has XML Node Prototype Pollution that to RCE

April 29, 2026 (updated May 8, 2026)

An authenticated user with permission to create or modify workflows could achieve global prototype pollution via the XML Node leading to RCE when combined with other nodes exploiting the prototype pollution.

References

github.com/advisories/GHSA-hqr4-h3xv-9m3r
github.com/n8n-io/n8n
github.com/n8n-io/n8n/security/advisories/GHSA-hqr4-h3xv-9m3r
nvd.nist.gov/vuln/detail/CVE-2026-42232

Code Behaviors & Features

Detect and mitigate CVE-2026-42232 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →