A prototype pollution vulnerability in the xml2js library used by n8n's webhook XML body parser allows an authenticated user with workflow modification permissions to achieve remote code execution (RCE) on the n8n host. The flaw is fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1. Until patched, restricting workflow creation and editing to trusted users can serve as a temporary mitigation.