CVE-2026-44791: n8n prototype pollution in XML node leading to RCE

Executive brief

n8n is a popular workflow automation tool used to connect different software services. A security flaw in its XML processing component allows an authorized user to gain full control over the server hosting the application. This could lead to the theft of sensitive credentials, data exposure, or a complete shutdown of automated business operations.

Technical details

A prototype pollution vulnerability (CWE-1321) exists in the n8n XML node due to an incomplete patch for a previous vulnerability. An authenticated attacker with permissions to create or modify workflows can exploit this by crafting malicious XML data that modifies the JavaScript object prototype. When combined with other nodes in a workflow, this can be escalated to Remote Code Execution (RCE) on the n8n host. The vulnerability is reachable over the network and requires low privileges. Patches are available in versions 1.123.43, 2.20.7, and 2.22.1.

Affected products

• n8n-io n8n < 1.123.43, >= 2.0.0-rc.0, < 2.20.7, >= 2.21.0, < 2.22.1

Timeline

• 2026-05-13: disclosed
• 2026-05-14: advisory

References

• https://api.github.com/users/simonkoeck
• https://github.com/simonkoeck
• https://api.github.com/users/simonkoeck/gists%7B/gist_id%7D
• https://api.github.com/users/simonkoeck/repos
• https://avatars.githubusercontent.com/u/54739715?v=4
• https://api.github.com/users/simonkoeck/events%7B/privacy%7D