Executive brief
n8n is a workflow automation platform that allows users to create and manage automated tasks and integrations. An authenticated user with permission to create or modify workflows could inject malicious expressions that execute arbitrary system commands on the server running n8n, potentially compromising the entire system and any data it handles.
Technical details
This vulnerability is an expression escape flaw (CWE-913) in n8n's expression evaluation system, following a previous issue (CVE-2025-68613). An authenticated attacker with workflow creation or modification permissions can craft malicious expressions in workflow parameters to bypass security controls and achieve remote code execution on the host system. The attack requires authentication and workflow editing privileges, but requires no user interaction once those permissions are obtained. The vulnerability affects n8n versions before 1.123.17 and 2.0.0 through 2.5.1, with patches available in versions 1.123.17 and 2.5.2.
Affected products
- n8n n8n before 1.123.17 and 2.0.0 through 2.5.1
Timeline
- 2026-02-04: disclosed
- 2026-02-04: patched: versions 1.123.17 and 2.5.2