Vulnerability · Published Feb 25, 2026 · Assigned by GitHub_M
CVE-2026-27577n8n: Expression Sandbox Escape Leads to RCE
Critical 9.4
In plain English
A critical-severity code injection in n8n from n8n-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 10.7% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, additional exploits in the expression evaluation of n8n have been identified and patched following CVE-2025-68613. An authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host running n8n. The issues have been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate all known vulnerabilities. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only, and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | n8n | 1.123.22 | GHSA-vpcf-gvg4-6qwr |
| npm | n8n | 2.9.3 | GHSA-vpcf-gvg4-6qwr |
| npm | n8n | 2.10.1 | GHSA-vpcf-gvg4-6qwr |
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References
- https://github.com/n8n-io/n8n/security/advisories/GHSA-vpcf-gvg4-6qwr x_refsource_CONFIRM
- https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp x_refsource_MISC
- https://github.com/n8n-io/n8n/commit/1479aab2d32fe0ee087f82b9038b1035c98be2f6 x_refsource_MISC
- https://github.com/n8n-io/n8n/commit/9e5212ecbc5d2d4e6f340b636a5e84be6369882e x_refsource_MISC
- https://docs.n8n.io/hosting/securing/overview x_refsource_MISC