CVE-2026-33696: From a Schema Name to RCE in n8n

CVE-2026-33696 describes a critical vulnerability in the n8n platform that allows an attacker to execute remote code (RCE) through a seemingly innocuous feature. During routine auditing of n8n’s node implementations, the researcher noticed a pattern where user-supplied strings were used as property keys on plain objects without proper validation.

This oversight led to the discovery of a flaw in the GSuiteAdmin node, which has a "Custom Fields" section allowing users to input a schema name, field name, and value. The schema name is directly used as a dynamic key to group fields, making it a potential vector for exploitation.

If the schema name is set to "__proto__", the vulnerability is triggered, as it allows the attacker to write to Object.prototype. This pollution of the prototype chain has severe consequences, as every subsequent plain object created inherits the polluted property. This not only leads to the crash of the entire n8n instance through TypeORM, but it also sets the stage for full RCE.

The researcher found that the simple-git node uses environment variables, which inherit from Object.prototype. By further polluting the GIT_SSH_COMMAND property within Object.prototype, the attacker can execute arbitrary commands when the Git node spawns a child process. The entire attack can be initiated with a single HTTP request from a webhook, causing the GSuiteAdmin node to fail even if it encounters an API call error, and subsequently allowing the Git node to execute the attacker's command as the n8n process user.

Moreover, the pollution of Object.prototype is destructive on its own. When TypeORM's buildWhere function iterates over the polluted properties, it throws EntityPropertyNotFoundError on every database query, rendering the n8n UI unresponsive and causing all workflow executions to fail. The only solution to restore the system is a full restart of the instance.

To mitigate this vulnerability, n8n should implement a straightforward fix by rejecting dangerous property names before using them as object keys. A blocklist check for "__proto__", "constructor", and "prototype" on the schemaName value, or utilizing Object.create(null) for custom schemas, would prevent the pollution entirely. Despite the existence of deepMerge utility with prototype pollution guards in n8n's codebase, the GSuiteAdmin node failed to incorporate this protection.