CVE-2026-42232 Security Alert: CRITICAL Vulnerability
Urgent: CVE-2026-42232 requires immediate attention.
· 3 min read
```htmlExecutive Summary
A critical vulnerability, identified as CVE-2026-42232, has been discovered in the npm package n8n. This flaw allows authenticated users with workflow modification permissions to achieve global prototype pollution, potentially leading to remote code execution (RCE). Immediate action is required to protect your applications.
Immediate Action
- Upgrade to
n8nversion1.123.32,2.17.4, or2.18.1or later. - If you cannot upgrade immediately, limit workflow creation and editing permissions to trusted users only.
- Disable the XML node by adding
n8n-nodes-base.xmlto theNODES_EXCLUDEenvironment variable. - Monitor for updates from the vendor for any additional guidance: Vendor Advisory.
Affected Versions
n8n@<=1.123.31vulnerable; upgrade to1.123.32+n8n@<=2.17.3vulnerable; upgrade to2.17.4+n8n@<=2.18.0vulnerable; upgrade to2.18.1+
Resolution Guide
To resolve this vulnerability, execute the following commands based on your package manager:
npm install n8n@1.123.32
npm install n8n@2.17.4
npm install n8n@2.18.1
If you are unable to upgrade, you can temporarily disable the XML node by modifying your environment variables:
export NODES_EXCLUDE=n8n-nodes-base.xml
For a code fix, ensure that the following snippet is included in your workflow validation:
// Ensure the XML node is not included
if (workflow.includes('n8n-nodes-base.xml')) {
throw new Error('XML node is disabled due to security concerns.');
}
Detection & Verification
To check if your version of n8n is vulnerable, run the following command:
npm list n8n
To verify that the upgrade was successful, check the installed version:
npm list n8n | grep n8n
Risk and Impact
The exploitation of CVE-2026-42232 could allow an attacker to manipulate the application’s prototype chain, leading to remote code execution. This vulnerability poses a significant risk, especially for solo developers and small teams, as it could compromise sensitive data and system integrity across any affected workflows.
```