Executive brief
n8n is a workflow automation platform used to connect different business applications and automate tasks. A security vulnerability allows an authorized user to execute malicious commands on the server hosting the application. This could lead to a full takeover of the system, theft of sensitive data from connected services, or disruption of automated business processes.
Technical details
A Remote Code Execution (RCE) vulnerability exists in n8n's workflow expression evaluation system due to insufficient isolation of the execution context from the underlying Node.js runtime. An authenticated attacker with permissions to configure workflows can provide specially crafted expressions that escape the intended sandbox. This allows for the execution of arbitrary code with the privileges of the n8n process. The vulnerability is being actively exploited in the wild, notably by the Zerobot malware. Patches are available in versions 1.120.4, 1.121.1, and 1.122.0.
Affected products
- n8n n8n 0.211.0 to < 1.120.4, 1.121.0 to < 1.121.1, < 1.122.0
Timeline
- 2025-12-19: disclosed: Initial CVE entry created
- 2026-03-11: kev added: CISA added to Known Exploited Vulnerabilities catalog
- 2026-03-11: advisory: NVD published detailed advisory