A Schema Name Becomes a Shell in n8n's Latest RCE

A schema name you never validated

The bug at the center of CVE-2026-33696 is the kind you've written yourself and gotten away with. In n8n's GSuiteAdmin node, custom schema fields get stitched into an object using a user-supplied string as the key:

customSchemas[schemaName] ??= {};
(customSchemas[schemaName] as IDataObject)[fieldName] = value;

Set schemaName to __proto__ and that second line stops writing to your object and starts writing to Object.prototype. Every plain object in the process now inherits whatever field/value pair you supplied. That's textbook prototype pollution, CWE-1321, and on its own it's usually a nuisance — a crashed query layer, a bypassed access check. The reason this one carries a 9.4 CVSS is what security researcher Simon Koeck chained it into: a clean path from a JSON body to shell execution, documented in his writeup.

The gadget that turns pollution into RCE

Prototype pollution is only as dangerous as the "gadget" you can reach downstream — some code that later reads a property it never set and does something trusting with it. Koeck's gadget is one every Node.js shop should have memorized by now: environment-variable inheritance through child_process.spawn.

n8n's Git node builds a git subprocess with simple-git, whose .env() helper starts from a plain object. After pollution, that object inherits an attacker-controlled GIT_SSH_COMMAND. When spawn assembles the child environment it walks inherited properties too, so the poisoned variable rides along into git — and git dutifully executes GIT_SSH_COMMAND as a shell command whenever it opens an SSH transport. Pollute in the GSuiteAdmin node, trigger a git operation elsewhere in the same workflow, and you have code execution as the n8n process user. From there it's the usual endgame: the credential encryption key, every stored OAuth token, the database.

GIT_SSH_COMMAND is not an exotic find. It's been a reliable pollution sink since the 2018–2019 wave of Node.js prototype-pollution research, alongside NODE_OPTIONS and lodash merge. What makes the n8n case worth studying isn't novelty — it's that the codebase already had prototype-pollution guards in shared utilities. They just weren't wired into these particular nodes. That's the recurring failure mode for low-code platforms: security is a property of individual node authors, and n8n ships hundreds of nodes.

The "authenticated" caveat matters more than it sounds

Read the marketing version of this and you'll see "unauthenticated webhook to RCE." Read the official advisory and it's narrower: exploitation requires an authenticated user with permission to create or modify workflows. The vector is Privileges Required: Low, not None. Anyone whose threat model treats the workflow editor as a trusted, admin-only surface can breathe slightly slower.

Almost nobody's threat model should. n8n's whole value proposition is handing the workflow canvas to analysts, ops staff, and business users — the people you don't want holding a shell on the host. In any multi-user n8n deployment, "can edit a workflow" is a low bar that a lot of accounts clear, and this bug converts that permission into full host compromise. Treat editor access as equivalent to SSH access until you're patched. If you self-host with a shared instance, that reframing alone should move your patch window from "this sprint" to "today."

Patch, and don't stop at one CVE

Fixed releases are 1.123.27 on the 1.x LTS line, 2.13.3 on 2.x stable, and 2.14.1 for anyone running the 2.14.0 beta. The fix is the obvious one — validate keys or build these objects with Object.create(null) so there's no prototype to pollute.

If you can't deploy immediately, the interim control is NODES_EXCLUDE. Setting it to disable the vulnerable nodes closes the path without touching the rest of your automations:

NODES_EXCLUDE=n8n-nodes-base.xml,n8n-nodes-base.merge

Note the xml node in there. CVE-2026-33696 covers prototype pollution in both the XML and GSuiteAdmin nodes, so excluding GSuiteAdmin alone isn't enough. And this CVE didn't ship alone. The same March 2026 batch includes CVE-2026-33660 (CVSS 9.4), where the Merge node's "Combine by SQL" mode leans on the AlaSQL sandbox loosely enough to read local files and reach RCE — hence merge in that exclude list too. Seven advisories rated High or Critical landed together. If you patched one and moved on, you're not done; take the whole release, not a hotpatch.

The broader read

n8n is having the security-maturity moment every successful self-hosted automation tool goes through. The platform is now load-bearing infrastructure — it holds credentials for your Google Workspace, your databases, your cloud accounts — which makes it a high-value target, and its plugin-node architecture gives it an enormous, unevenly-audited attack surface. A cluster of prototype-pollution and sandbox-escape bugs in the same month isn't a fluke; it's what happens when researchers finally point serious effort at a codebase that grew fast.

The practical takeaway for anyone running it: stop treating your n8n instance like a convenience tool and start treating it like the secrets vault it actually is. Put it behind SSO, keep the editor off the public internet, scope workflow-edit permissions tightly, and subscribe to the advisory feed. The class of bug here — user string used as an object key, poisoned env var inherited by spawn — will keep resurfacing across the Node.js automation ecosystem. n8n won't be the last tool where a schema name becomes a shell.