CVE-2026-42231

GHSA-q5f4-99jv-pgg5 — n8n XML Webhook Prototype Pollution → RCE CVE: CVE-2026-42231 Severity: Critical CVSS 10.0 Affected: n8n element. xml2js 0.6.2 uses Object.defineProperty with a data descriptor to set element keys on parsed objects. Because 'proto' in obj is always true, assignOrPush wraps t...

CLSA-2026-1777336771 TuxCare security update for xml2js (1 CVE)

TuxCare rebuilt xml2js to address 1 CVE. Fixed in 0.4.4-tuxcare.1...

CLSA-2026-1773879454 TuxCare security update for xml2js (1 CVE)

TuxCare rebuilt xml2js to address 1 CVE. Fixed in 0.2.6-tuxcare.1...

CLSA-2026-1773879452 TuxCare security update for xml2js (1 CVE)

TuxCare rebuilt xml2js to address 1 CVE. Fixed in 0.4.23-tuxcare.1...

CLSA-2026-1773879453 TuxCare security update for xml2js (1 CVE)

TuxCare rebuilt xml2js to address 1 CVE. Fixed in 0.2.8-tuxcare.1...

PT-2026-74627

TuxCare rebuilt xml2js to address 1 CVE. Fixed in 0.4.4-tuxcare.1...

PT-2026-74014

TuxCare rebuilt xml2js to address 1 CVE. Fixed in 0.4.23-tuxcare.1...

PT-2026-74016

TuxCare rebuilt xml2js to address 1 CVE. Fixed in 0.2.6-tuxcare.1...

PT-2026-74015

TuxCare rebuilt xml2js to address 1 CVE. Fixed in 0.2.8-tuxcare.1...

CVE-2026-42231

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the xml2js library used to parse XML request bodies in n8n's webhook handler allowed prototype pollution via a crafted XML payload. An authenticated user with permission to create or modi...

EUVD-2026-27102

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the xml2js library used to parse XML request bodies in n8n's webhook handler allowed prototype pollution via a crafted XML payload. An authenticated user with permission to create or modi...

n8n security vulnerabilities

n8n is an open-source, scalable workflow automation tool developed by n8n. Versions of n8n prior to 1.123.32, 2.17.4, and 2.18.1 contained security vulnerabilities. These vulnerabilities were due to a prototype pollution issue in the xml2js library used for parsing XML request bodies. This...

CVE-2026-42231: Improperly Controlled Modification of Object Prototype Attributes

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the xml2js library used to parse XML request bodies in n8n's webhook handler allowed prototype pollution via a crafted XML payload. An authenticated user with permission to create or modi...

Prototype Pollution

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Prototype Pollution via the xml2js used for parsing XML request bodies in webhook handlers. An authenticated attacker with permission to create or modify workflows could exploit this to pollute the...

MAL-2026-234 Malicious code in xml2js-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c18f9df8257f4f610dbfd70460757eb36539314c7cce4d9eda82758da6984725 The package xml2js-js was found to contain malicious code. Source: ghsa-malware cf7cd10255ee6ff91469e7f180436d90c3eca29de3dc0b3f883c13403ca30132 Any...

EUVD-2026-1976

Malicious code in xml2js-js npm...

Malicious Package

Overview xml2js-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in xml2js-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c18f9df8257f4f610dbfd70460757eb36539314c7cce4d9eda82758da6984725 The package xml2js-js was found to contain malicious code. Source: ghsa-malware cf7cd10255ee6ff91469e7f180436d90c3eca29de3dc0b3f883c13403ca30132 Any...

EUVD-2023-1222

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2023-0842

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validat...