An authenticated user with workflow creation or modification permissions in n8n can exploit a prototype pollution vulnerability in the XML Node to achieve remote code execution (RCE). The vulnerability is fixed in versions 1.123.32, 2.17.4, and 2.18.1. Until upgrading, administrators should restrict workflow editing permissions and consider disabling the XML node as temporary mitigations.