CVE-2026-27493 is a critical vulnerability classified under CWE-94 (Improper Control of Generation of Code) and CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code) affecting the n8n workflow automation platform. The vulnerability exists in n8n's Form nodes prior to versions 2.10.1, 2.9.3, and 1.123.22, where a second-order expression injection flaw allows an unauthenticated attacker to submit crafted form data that begins with an '=' character. This prefix causes n8n to interpret the input as an expression and evaluate it twice, enabling injection and evaluation of arbitrary n8n expressions. Exploitation requires a workflow configured with a form node that interpolates unauthenticated user input, a condition not commonly met and unlikely to persist unnoticed due to the unusual '=' prefix. The injected expressions are initially limited to the n8n expression context, restricting impact. However, if combined with a separate sandbox escape vulnerability, an attacker can escalate this to remote code execution on the host system running n8n. This chaining significantly increases the threat level. The vulnerability does not require authentication or user interaction, making it more dangerous. The issue has been addressed in the specified fixed versions, and users are strongly advised to upgrade. Temporary mitigations include manually reviewing workflows for vulnerable form nodes and disabling the Form and Form Trigger nodes via environment variable exclusions, though these do not fully eliminate risk. No known exploits have been reported in the wild as of the publication date.

The vulnerability poses a critical risk to organizations using affected versions of n8n, as it allows unauthenticated attackers to inject and evaluate arbitrary expressions, potentially leading to remote code execution if combined with a sandbox escape. This can result in full compromise of the host system, including unauthorized access to sensitive data, disruption of automated workflows, and lateral movement within networks. Given n8n's role in automating business processes and integrating multiple services, exploitation could disrupt critical operations and lead to data breaches or service outages. The lack of authentication and user interaction requirements lowers the barrier for attackers, increasing the likelihood of exploitation in targeted environments. Organizations relying on n8n for workflow automation in cloud or on-premises deployments are at risk, especially if workflows include form nodes accepting unauthenticated input. The impact extends to confidentiality, integrity, and availability of systems and data, with potential cascading effects on connected services and infrastructure.

The primary mitigation is to upgrade n8n installations to versions 2.10.1, 2.9.3, or 1.123.22 or later, where the vulnerability is fixed. Until upgrades can be performed, administrators should conduct a thorough manual audit of workflows to identify any form nodes that interpolate unauthenticated user input and check for fields starting with '='. If such workflows exist, consider redesigning them to avoid this pattern or restrict access to trusted users only. As a temporary measure, disable the vulnerable Form node by adding 'n8n-nodes-base.form' and the Form Trigger node by adding 'n8n-nodes-base.formTrigger' to the 'NODES_EXCLUDE' environment variable to prevent their use. This reduces attack surface but does not fully eliminate risk, so it should only be a short-term solution. Additionally, monitor n8n logs and network traffic for suspicious activity indicative of exploitation attempts. Implement network segmentation and host-based protections to limit potential damage from a successful compromise. Stay informed about any sandbox escape vulnerabilities that could be chained with this issue and apply patches promptly.