Report · SecurityWeekAbout CVE-2026-25049Published 5 Feb 2026

Critical N8n Sandbox Escape Could Lead to Server Compromise

Source SecurityWeek

Authoritative record:CVE-2026-25049· Critical 9.4

Not known to be exploited · CVSS 9.4 Critical : upgrade to 2.5.2 or 1.123.17 as a priority.

Data as of 5 Feb 2026, 11:29 UTC

CVSS base score

9.4Critical

How severe the flaw is on the 0–10 CVSS scale.

Patch: Available – fixed in 2.5.2, 1.123.17

Exploitation evidence

Disclosed: evidence found.
CVE published 4 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade n8n and n8n-io/n8n to 2.5.2 or 1.123.17.

Affected software

Product	Affected	Fixed in
n8n-ion8n	Affected <1.123.17 <2.5.2	Fixed in 2.5.2 1.123.17
GitHubn8n-io/n8n`pkg:github/n8n-io/n8n`Other threats	Affected <1.123.17 <2.5.2	Fixed in 1.123.17 2.5.2

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

To mitigate this vulnerability, organizations should immediately review their use of the n8n platform and restrict access to n8n servers to trusted networks and users only. Network segmentation and firewall rules should be implemented to limit exposure. Monitoring and logging of n8n server activity should be enhanced to detect unusual or unauthorized command execution attempts. In the absence of patches, consider disabling or limiting the use of custom JavaScript expressions within workflows or replacing them with safer alternatives. Conduct thorough code reviews of workflows to identify potentially dangerous scripts. Employ runtime application self-protection (RASP) or endpoint detection and response (EDR) tools to detect and block exploitation attempts. Finally, maintain regular backups of critical data and workflows to enable recovery in case of compromise.

Description

A critical sandbox escape vulnerability (CVE-2026-25049) in the n8n AI workflow automation platform allows attackers to bypass the sandbox's JavaScript sanitization and execute arbitrary commands on the server. This flaw arises from improper evaluation of JavaScript expressions within the sandbox, enabling potential full server compromise. Although no known exploits are currently reported in the wild, the high severity and ease of exploitation make this a significant threat. European organizations using n8n for automation workflows face risks of data breaches, service disruption, and unauthorized access. Immediate patching and sandbox hardening are essential to mitigate this vulnerability. Countries with high adoption of automation tools and strong digital infrastructure, such as Germany, France, and the UK, are particularly at risk. Defenders should prioritize restricting n8n server access, monitoring unusual activity, and applying vendor updates once available. Given the critical impact on confidentiality, integrity, and availability without requiring user interaction, this vulnerability is assessed as critical severity.

Impact

For European organizations, the impact of this vulnerability is substantial. n8n is widely used for automating workflows that integrate various business-critical applications and data sources. A successful sandbox escape could lead to unauthorized access to sensitive corporate data, disruption of automated processes, and potential lateral movement within the network. This could result in data breaches, operational downtime, and reputational damage. Organizations in sectors such as finance, healthcare, manufacturing, and government, which rely heavily on automation and AI workflows, are particularly vulnerable. The ability to execute arbitrary commands on servers could also facilitate ransomware deployment or espionage activities. Given Europe's strict data protection regulations like GDPR, a breach resulting from this vulnerability could lead to significant legal and financial penalties. The threat is exacerbated by the ease of exploitation and the lack of required user interaction, making it a high priority for incident response and risk mitigation.

Summary

The vulnerability identified as CVE-2026-25049 affects the n8n AI workflow automation platform, specifically its sandbox environment designed to safely execute JavaScript expressions. The sandbox's sanitization routine, which is intended to prevent malicious code execution, fails to properly evaluate certain JavaScript expressions, allowing attackers to escape the sandbox constraints. This sandbox escape enables arbitrary command execution on the underlying server hosting n8n, effectively granting attackers full control over the system. The vulnerability is critical, with a CVSS score of 9.4, indicating a high likelihood of exploitation and severe impact. Exploitation does not require user interaction or authentication, increasing the risk profile. Although no active exploits have been reported, the nature of the flaw suggests that attackers could leverage it to execute malicious workflows, deploy ransomware, exfiltrate sensitive data, or disrupt services. The vulnerability affects all versions of n8n that use the flawed sandbox implementation, which is common in deployments automating business processes and AI workflows. The issue is rooted in JavaScript's dynamic evaluation and the sandbox's inability to fully sanitize or restrict dangerous expressions, a common challenge in securing script execution environments.

References

securityweek.com/critical-n8n-sandbox-escape-could-lead-to-server-compromise/ (opens in a new tab)

Community reviews

Loading reviews…