Nixpkgs security tracker
NIXPKGS-2026-1397
GitHub issue
published on
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
3 packages
- n8n-nodes-carbonejs
- n8n-nodes-evolution-api
- n8n-task-runner-launcher
- @LeSuisse accepted
- @LeSuisse published on GitHub
n8n: XML Node Prototype Pollution to RCE
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the XML Node leading to RCE when combined with other nodes exploiting the prototype pollution. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.
References
-
https://github.com/n8n-io/n8n/security/advisories/GHSA-hqr4-h3xv-9m3r x_refsource_CONFIRM
Affected products
n8n
- ==< 1.123.32
- ==>= 2.18.0, < 2.18.1
- ==>= 2.17.0, < 2.17.4
Matching in nixpkgs
Ignored packages (3)
pkgs.n8n-nodes-carbonejs
n8n community node for rendering Word templates using Carbone.js
pkgs.n8n-nodes-evolution-api
Evolution API hub for WhatsApp integration with n8n
pkgs.n8n-task-runner-launcher
Launcher for n8n task runners
Package maintainers
-
@sweenu sweenu <contact@sweenu.xyz>
-
@AdrienLemaire Adrien Lemaire <lemaire.adrien@gmail.com>
-
@gepbird Gutyina Gergő <gutyina.gergo.2@gmail.com>