CVE-2026-33696

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.14.1 n8n versions prior to 2.13.3 n8n versions prior to 1.123.27

Description An authenticated user with permissions to create or modify workflows can exploit a prototype pollution issue within the XML and GSuiteAdmin nodes. By providing crafted parameters during node configuration, an attacker can write controlled values to Object.prototype. This prototype pollution can be leveraged to achieve remote code execution on the n8n instance. Technical analysis indicates that after Object.prototype is polluted, the buildWhere() function in TypeORM may pick up these extra properties during iteration, leading to an EntityPropertyNotFoundError during database queries.

Recommendations Upgrade to version 2.14.1 or later. Upgrade to version 2.13.3 or later. Upgrade to version 1.123.27 or later. Limit workflow creation and editing permissions to fully trusted users only. Disable the XML node by adding n8n-nodes-base.xml to the NODES EXCLUDE environment variable.