CVE-2026-42231: 
NixOS vulnerability analysis and mitigation

CVE-2026-42231 is a prototype pollution vulnerability in n8n's XML webhook body parser that can be chained to achieve remote code execution (RCE) on the n8n host. The flaw resides in the xml2js library used to parse XML request bodies in n8n's webhook handler. Affected versions include all n8n releases prior to 1.123.32, versions 2.17.0–2.17.3, and version 2.18.0. The vulnerability was published on April 22, 2026, and disclosed publicly on April 29, 2026. It carries a CVSS v3.1 score of 8.8 (High) and a CVSS v4.0 score of 9.4 (Critical) (GitHub Advisory, n8n Security Advisory).

The root cause is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes — 'Prototype Pollution'). The xml2js library, used by n8n's webhook handler to parse incoming XML request bodies, does not sanitize keys that can overwrite properties on the JavaScript Object.prototype. An authenticated attacker crafts a malicious XML payload that pollutes the prototype, then chains this pollution with the Git node's SSH operations — which rely on prototype-inherited properties — to inject arbitrary OS commands executed on the n8n host. Exploitation requires network access to the n8n instance and an authenticated account with workflow creation or modification privileges (GitHub Advisory, dexpose.io).

Successful exploitation grants an attacker full remote code execution on the n8n host, with high impact to confidentiality, integrity, and availability of both the vulnerable system and subsequent systems. An attacker can exfiltrate sensitive workflow data, credentials stored in n8n, and any secrets accessible to the n8n process, as well as modify or destroy workflows and underlying data. The CVSS v4.0 scoring reflects high subsequent system impact, indicating potential for lateral movement to connected services and infrastructure reachable from the n8n host (GitHub Advisory, n8n Security Advisory).

A fully functional public proof-of-concept exploit is available on GitHub (rudSarkar/CVE-2026-42231), including exploit.sh for automated deployment of a vulnerable Docker environment and poc_GHSA-q5f4-99jv-pgg5.py for delivering RCE payloads via the --cmd parameter (PoC Repository). As of the latest intelligence, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been reported. The EPSS score is approximately 0.30–0.47%, placing it in the 65th percentile for exploitation probability within 30 days. The vulnerability is not currently listed in the CISA KEV catalog. Qualys has published a detection (ID 531332) for this vulnerability (GitHub Advisory).

1. Reconnaissance: Identify internet-facing n8n instances using Shodan, Censys, or similar tools, targeting versions below 1.123.32, 2.17.4, or 2.18.1. Confirm the instance accepts XML-formatted webhook payloads.
2. Obtain authenticated access: Log in with any account that has workflow creation or modification permissions (e.g., a low-privilege user account or a self-registered account on open instances).
3. Craft prototype pollution payload: Construct a malicious XML body that injects a key such as __proto__ or constructor.prototype with attacker-controlled values. For example:

<root>
  <__proto__>
    <polluted>injected_value</polluted>
  </__proto__>
</root>

4. Send payload to webhook endpoint: POST the crafted XML body to a webhook URL associated with a workflow on the target n8n instance, triggering the vulnerable xml2js parser in the webhook handler.
5. Chain with Git node SSH operations: Create or modify a workflow that uses the Git node with SSH operations. The polluted prototype properties are inherited by the SSH command construction logic, allowing injection of arbitrary OS commands into the SSH invocation.
6. Achieve RCE: Trigger the workflow execution. The injected command runs on the n8n host as the n8n service account, enabling reverse shell establishment, data exfiltration, or further lateral movement (PoC Repository, dexpose.io).

• Network: Unusual HTTP POST requests to n8n webhook endpoints (/webhook/<id>) with Content-Type: application/xml containing __proto__, constructor, or prototype keys in the XML body; unexpected outbound connections (reverse shells) from the n8n host to external IPs on non-standard ports.
• Logs: n8n application logs showing XML parsing errors or unexpected prototype-related keys in webhook body processing; Git node execution logs with anomalous SSH command arguments or unexpected command strings.
• File System: New or modified files in the n8n working directory or /tmp created by the n8n process; unexpected SSH key files or known_hosts modifications; web shells or scripts dropped by the n8n service account.
• Process: Unusual child processes spawned by the n8n Node.js process (e.g., bash, sh, curl, wget, python, nc); unexpected git or ssh subprocess invocations with attacker-controlled arguments.
• Workflow Changes: New or recently modified workflows containing Git nodes with SSH operations created by non-administrative users, especially shortly after XML webhook activity (PoC Repository, GitHub Advisory).

Upgrade n8n to one of the patched versions: 1.123.32, 2.17.4, or 2.18.1 (or any later release). If immediate upgrading is not possible, restrict workflow creation and editing permissions to fully trusted users only, as this limits the attacker's ability to create or modify workflows needed to chain the exploit. Note that this workaround does not fully eliminate the risk and should only be used as a short-term measure. Organizations should also consider blocking or rate-limiting XML-formatted webhook requests at the network perimeter until patching is complete (n8n Security Advisory, GitHub Advisory).

The Belgian Centre for Cybersecurity (CCB) issued a warning urging immediate patching of n8n (CCB Advisory), and Singapore's CSA published an alert (AL-2026-057) covering the vulnerability. The Hacker News covered the vulnerability as part of a broader enterprise patch wave alongside Ivanti, Fortinet, SAP, and VMware flaws (The Hacker News). Security researchers published a detailed technical write-up on dexpose.io tracing the full exploit chain from XML parsing bug to RCE, which was also mirrored on Malware.news (dexpose.io). Community discussion on Reddit's r/pwnhub highlighted the severity of the chained exploit technique.