CVE-2026-44791: n8n Has an XML Node Prototype Pollution Patch Bypass

May 14, 2026 (updated July 20, 2026)

An authenticated user with permission to create or modify workflows could bypass the patch for GHSA-hqr4-h3xv-9m3r in the XML node. When combined with other nodes, this could lead to RCE on the n8n host.

References

github.com/advisories/GHSA-hqr4-h3xv-9m3r
github.com/advisories/GHSA-wrwr-h859-xh2r
github.com/n8n-io/n8n/security/advisories/GHSA-wrwr-h859-xh2r
nvd.nist.gov/vuln/detail/CVE-2026-44791

Code Behaviors & Features

Detect and mitigate CVE-2026-44791 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →