n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, a second-order expression injection vulnerability existed in n8n's Form nodes that could allow an unauthenticated attacker to inject and evaluate arbitrary n8n expressions by submitting crafted form data. When chained with an expression sandbox escape, this could escalate to remote code execution on the n8n host. The vulnerability requires a specific workflow configuration to be exploitable. First, a form node with a field interpolating a value provided by an unauthenticated user, e.g.a form submitted value. Second, the field value must begin with an `=` character, which caused n8n to treat it as an expression and triggered a double-evaluation of the field content. There is no practical reason for a workflow designer to prefix a field with `=` intentionally — the character is not rendered in the output, so the result would not match the designer's expectations. If added accidentally, it would be noticeable and very unlikely to persist. An unauthenticated attacker would need to either know about this specific circumstance on a target instance or discover a matching form by chance. Even when the preconditions are met, the expression injection alone is limited to data accessible within the n8n expression context. Escalation to remote code execution requires chaining with a separate sandbox escape vulnerability. The issue has been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Review usage of form nodes manually for above mentioned preconditions, disable the Form node by adding `n8n-nodes-base.form` to the `NODES_EXCLUDE` environment variable, and/or disable the Form Trigger node by adding `n8n-nodes-base.formTrigger` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
n8n is an open source workflow automation platform. Prior to 1.121.0, there is a vulnerability in the HTTP Request node's credential domain validation allowed an authenticated attacker to send requests with credentials to unintended domains, potentially leading to credential exfiltration. This only might affect user who have credentials that use wildcard domain patterns (e.g., *.example.com) in the "Allowed domains" setting. This issue is fixed in version 1.121.0 and later.
n8n is an open source workflow automation platform. From version 0.187.0 to before 1.120.3, a command injection vulnerability was identified in n8n’s community package installation functionality. The issue allowed authenticated users with administrative permissions to execute arbitrary system commands on the n8n host under specific conditions. This issue has been patched in version 1.120.3.
CVE-2026-25115 is a critical vulnerability in the n8n workflow automation platform versions prior to 2.4.8. It allows authenticated users to escape the Python sandbox in the Python Code node, enabling execution of arbitrary code outside the intended security boundary. This flaw stems from a protection mechanism failure (CWE-693) and does not require user interaction or elevated privileges beyond authentication. The vulnerability has a CVSS 4.0 base score of 9.4, indicating high exploitability and severe impact on confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, exploitation could lead to full system compromise. European organizations using affected versions of n8n are at risk, especially those relying on automation workflows for critical business processes.
CVE-2026-25056 is a critical vulnerability in the n8n workflow automation platform affecting versions prior to 1.118.0 and 2.4.0. It allows authenticated users with workflow creation or modification permissions to exploit the Merge node's SQL Query mode to write arbitrary files to the server filesystem. This unrestricted file upload can lead to remote code execution without requiring user interaction. The vulnerability has a high CVSS 4.0 score of 9.4, indicating severe impact on confidentiality, integrity, and availability.
CVE-2026-25055 is a high-severity path traversal vulnerability in the open-source workflow automation platform n8n prior to versions 1.123.12 and 2.4.0. It arises when workflows process uploaded files and transfer them to remote servers via the SSH node without validating file metadata, allowing an unauthenticated attacker to write files to arbitrary locations on remote systems. Exploitation requires knowledge of existing vulnerable workflows and unauthenticated access to file upload endpoints. Successful exploitation can lead to remote code execution on the targeted remote servers. The vulnerability has been patched in the specified versions. No known exploits are currently reported in the wild.
CVE-2026-25054 is a high-severity Cross-Site Scripting (XSS) vulnerability in the n8n open source workflow automation platform, affecting versions prior to 1.123.9 and 2.2.1. The flaw exists in a markdown rendering component used in the user interface, including workflow sticky notes and other markdown-supported areas. An authenticated user with workflow creation or modification permissions can inject malicious scripts that execute with same-origin privileges when other users view the crafted workflows. This can lead to session hijacking and account takeover. The vulnerability requires authentication and some user interaction but does not require elevated privileges beyond workflow modification rights. No known exploits are currently reported in the wild.
CVE-2026-25053 is a critical OS command injection vulnerability in the n8n workflow automation platform affecting versions prior to 1.123.10 and 2.5.0. Authenticated users with permissions to create or modify workflows can exploit this flaw via the Git node to execute arbitrary system commands or read arbitrary files on the host system without user interaction. The vulnerability stems from improper neutralization of special elements in OS commands (CWE-78). It has a high CVSS 4.0 score of 9.4, indicating severe impact on confidentiality, integrity, and availability.
CVE-2026-25052 is a critical TOCTOU race condition vulnerability in the n8n workflow automation platform prior to versions 1.123.18 and 2.5.0. Authenticated users with workflow creation or modification permissions can exploit this flaw to bypass file access controls and read sensitive files on the host system. This exposure can lead to disclosure of critical configuration data and user credentials, enabling complete account takeover of any user on the affected instance. The vulnerability requires low privileges but no user interaction and can be exploited remotely. Although no known exploits are reported in the wild yet, the high CVSS score of 9.4 reflects its severe impact on confidentiality, integrity, and availability.
CVE-2026-25051 is a high-severity Cross-Site Scripting (XSS) vulnerability in the open-source workflow automation platform n8n prior to version 1.123.2. It arises from improper input neutralization in webhook responses and related HTTP endpoints, where the Content Security Policy sandbox is sometimes not correctly applied. An authenticated user with workflow creation or modification permissions can exploit this to execute malicious scripts with same-origin privileges when other users interact with the crafted workflow. This can lead to session hijacking and account takeover. The vulnerability requires authenticated access and some user interaction but does not require elevated privileges beyond workflow modification rights. No known exploits are currently reported in the wild. The issue has been patched in version 1.123.
CVE-2025-61917 is a high-severity vulnerability in the n8n workflow automation platform versions 1.65.0 through before 1.114.3. It arises from the unsafe use of Buffer.allocUnsafe() and Buffer.allocUnsafeSlow() in the task runner, which can lead to allocation of uninitialized memory buffers. These buffers may contain residual sensitive data such as secrets, tokens, or data from prior tasks within the same Node.js process, resulting in potential information disclosure.
CVE-2026-25049 is a critical vulnerability in the n8n workflow automation platform affecting versions prior to 1.123.17 and 2.5.2. Authenticated users with permissions to create or modify workflows can exploit crafted expressions in workflow parameters to execute arbitrary system commands on the host running n8n. This vulnerability arises from improper control of dynamically-managed code resources (CWE-913). No user interaction is required beyond authentication, and the exploit can lead to full system compromise. The issue has been patched in the specified versions. Although no known exploits are currently reported in the wild, the high CVSS score of 9.
CVE-2025-68949 is a medium-severity vulnerability in the n8n workflow automation platform versions 1.36.0 up to but not including 2.2.0. The flaw lies in the Webhook node’s IP whitelist validation, which uses partial string matching instead of exact IP comparison. This allows an attacker with a non-whitelisted IP address that shares a substring with a trusted IP to bypass IP-based access controls and invoke restricted webhooks. Both IPv4 and IPv6 addresses are affected. The vulnerability does not require authentication or user interaction and impacts confidentiality by potentially exposing restricted workflows. The issue is fixed in version 2.
CVE-2026-21894 is an authentication bypass vulnerability in the n8n workflow automation platform affecting versions 0.150.0 to before 2.2.2. The flaw exists in the Stripe Trigger node, where incoming webhook requests are not verified against the stored Stripe webhook signing secret. This allows unauthenticated attackers who know the webhook URL to send forged Stripe webhook events, triggering workflows without legitimate Stripe events. The risk is somewhat mitigated by the high-entropy UUID in the webhook URL, but authenticated users can view this URL, increasing exposure. Exploitation could lead to fake payment or subscription events influencing downstream processes. The vulnerability has been patched in version 2.
n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able to execute malicious code using the n8n service. This could result in full compromise and can impact both self-hosted and n8n Cloud instances. This issue is fixed in version 1.121.3. Administrators can reduce exposure by disabling the Git node and limiting access for untrusted users, but upgrading to the latest version is recommended.
n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker, resulting in exposure of sensitive information stored on the system and may enable further compromise depending on deployment configuration and workflow usage. This issue is fixed in version 1.121.0.
n8n is an open source workflow automation platform. Prior to version 2.0.0, in self-hosted n8n instances where the Code node runs in legacy (non-task-runner) JavaScript execution mode, authenticated users with workflow editing access can invoke internal helper functions from within the Code node. This allows a workflow editor to perform actions on the n8n host with the same privileges as the n8n process, including: reading files from the host filesystem (subject to any file-access restrictions configured on the instance and OS/container permissions), and writing files to the host filesystem (subject to the same restrictions). This issue has been patched in version 2.0.0. Workarounds for this issue involve limiting file operations by setting N8N_RESTRICT_FILE_ACCESS_TO to a dedicated directory (e.g., ~/.n8n-files) and ensure it contains no sensitive data, keeping N8N_BLOCK_FILE_ACCESS_TO_N8N_FILES=true (default) to block access to .n8n and user-defined config files, and disabling high-risk nodes (including the Code node) using NODES_EXCLUDE if workflow editors are not fully trusted.
n8n is an open source workflow automation platform. From version 1.0.0 to before 2.0.0, a sandbox bypass vulnerability exists in the Python Code Node that uses Pyodide. An authenticated user with permission to create or modify workflows can exploit this vulnerability to execute arbitrary commands on the host system running n8n, using the same privileges as the n8n process. This issue has been patched in version 2.0.0. Workarounds for this issue involve disabling the Code Node by setting the environment variable NODES_EXCLUDE: "[\"n8n-nodes-base.code\"]", disabling Python support in the Code node by setting the environment variable N8N_PYTHON_ENABLED=false, which was introduced in n8n version 1.104.0, and configuring n8n to use the task runner based Python sandbox via the N8N_RUNNERS_ENABLED and N8N_NATIVE_PYTHON_RUNNER environment variables.
n8n is an open source workflow automation platform. Prior to version 1.114.0, a stored Cross-Site Scripting (XSS) vulnerability may occur in n8n when using the “Respond to Webhook” node. When this node responds with HTML content containing executable scripts, the payload may execute directly in the top-level window, rather than within the expected sandbox introduced in version 1.103.0. This behavior can enable a malicious actor with workflow creation permissions to execute arbitrary JavaScript in the context of the n8n editor interface. This issue has been patched in version 1.114.0. Workarounds for this issue involve restricting workflow creation and modification privileges to trusted users only, avoiding use of untrusted HTML responses in the “Respond to Webhook” node, and using an external reverse proxy or HTML sanitizer to filter responses that include executable scripts.
n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. This issue has been fixed in versions 1.120.4, 1.121.1, and 1.122.0. Users are strongly advised to upgrade to a patched version, which introduces additional safeguards to restrict expression evaluation. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only; and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully eliminate the risk and should only be used as short-term measures.
