Junglewise Threat Intelligence

CVE-2026-1470: n8n unsafe workflow expression evaluation remote code execution

CVE-2026-1470 · Severity: low · CVSS 3.1 · Published 2026-01-27

Technologies: N8n. Vendors: N8n.

Executive brief

n8n is a popular automation and integration platform used to connect business applications and build workflows. A critical vulnerability allows authenticated users to execute arbitrary code on the n8n server by injecting malicious expressions into workflow configurations. An attacker with valid credentials could gain full control of the n8n instance, steal sensitive data, modify workflows, or use it as a launching point for further attacks on connected systems.

Technical details

The vulnerability exists in n8n's expression evaluation engine, which processes user-supplied expressions during workflow configuration. The root cause is insufficient isolation of the expression evaluation sandbox, allowing access to dangerous language constructs and system-level APIs (CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code). The attack requires authentication to the n8n instance, but no additional user interaction is needed beyond creating or modifying a workflow. An authenticated attacker can inject expressions that escape the sandbox and execute arbitrary system commands or Node.js code with the privileges of the n8n process. The fix involves restricting access to reserved variables and disallowing dangerous constructs like "with" statements, as evidenced by commits adding ExpressionReservedVariableError and ExpressionWithStatementError. Patches are available in versions 1.123.17, 2.4.5, and 2.5.1 or later.

Affected products

  • n8n n8n 0 to 1.123.16, 2.0.0 to 2.4.4, 2.5.0

Timeline

  • 2026-01-27: disclosed: Vulnerability published on GitHub Advisory Database
  • 2026-01-22: patched: Fix commits merged into n8n repository (25c4b96, 30383d8, aa4d1e5)

References

Related threats