The vulnerability identified as CVE-2026-42232 in n8n-io's n8n platform involves improper control over modification of object prototype attributes (CWE-1321), specifically through the XML Node. Authenticated users with workflow creation or modification permissions can trigger global prototype pollution, which may lead to remote code execution when combined with other vulnerable nodes. The flaw affects versions before 1.123.32, 2.17.4, and 2.18.1. The vendor has released patches in these versions to remediate the issue. The CVSS 4.0 base score is 9.4, indicating a critical severity with network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, availability, and security requirements.

Successful exploitation allows an authenticated user with workflow modification rights to perform global prototype pollution via the XML Node, potentially leading to remote code execution. This could compromise the integrity and availability of the affected system. The vulnerability is critical due to the high CVSS score and the possibility of full system compromise if exploited.

This vulnerability has been patched in n8n versions 1.123.32, 2.17.4, and 2.18.1. Users should upgrade to one of these versions or later to remediate the issue. Since the vulnerability requires authenticated access with workflow modification permissions, restricting such permissions to trusted users can reduce risk until patching is applied. Patch status is confirmed by the vendor advisory embedded in the description.