PT-2026-28079 · N8N · N8N

Published 2026-03-25 · Updated 2026-03-27 · CVE-2026-33696

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.14.1 n8n versions prior to 2.13.3 n8n versions prior to 1.123.27

Description n8n is a workflow automation platform susceptible to a prototype pollution issue in the XML and GSuiteAdmin nodes. An authenticated user with workflow creation or modification permissions can exploit this by supplying crafted parameters during node configuration, allowing them to write attacker-controlled values onto Object.prototype. This prototype pollution can potentially lead to remote code execution on the n8n instance.

Recommendations Upgrade to n8n version 2.14.1 or later. Upgrade to n8n version 2.13.3 or later. Upgrade to n8n version 1.123.27 or later. If upgrading is not immediately possible, limit workflow creation and editing permissions to fully trusted users only. If upgrading is not immediately possible, disable the XML node by adding n8n-nodes-base.xml to the NODES EXCLUDE environment variable.

Exploit

Fix

RCE

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-33696

GHSA-MXRG-77HM-89HV

Affected Products

N8N

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33696.json · Exploit
• https://github.com/n8n-io/n8n/security/advisories/GHSA-mxrg-77hm-89hv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33696 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mxrg-77hm-89hv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33696 · Security Note
• https://github.com/n8n-io/n8n · Note
• https://twitter.com/CVEnew/status/2036911818778829057 · Twitter Post
• https://twitter.com/0dayPublishing/status/2036868032014807123 · Twitter Post
• https://twitter.com/autumn_good_35/status/2037537235151786409 · Twitter Post
• https://twitter.com/cyberbivash/status/2036886249240248490 · Twitter Post