Junglewise Threat Intelligence

CVE-2026-27577: n8n code injection in expression evaluation

CVE-2026-27577 · Severity: critical · CVSS 9.9 · Published 2026-02-25

Technologies: N8n. Vendors: N8n.

Executive brief

n8n is an open-source workflow automation tool used to connect different software services and automate business tasks. A security vulnerability has been identified where an authorized user could execute unauthorized commands on the server hosting the application. This could lead to a complete system takeover, data theft, or disruption of business operations.

Technical details

This vulnerability is classified as Code Injection (CWE-94) within the expression evaluation engine of n8n. It follows a previous related vulnerability (CVE-2025-68613) and involves the improper sanitization of user-supplied expressions in workflow parameters. An authenticated attacker with workflow creation or modification privileges can bypass existing sandbox restrictions to execute arbitrary system commands on the underlying host. The attack is reachable over the network and requires low privileges but no user interaction. The issue is resolved in versions 2.10.1, 2.9.3, and 1.123.22.

Affected products

  • n8n-io n8n < 1.123.22, >= 2.0.0 < 2.9.3, >= 2.10.0 < 2.10.1

Timeline

  • 2026-02-25: advisory: Original GitHub Security Advisory published
  • 2026-02-25: patched: Fixes committed to n8n repository
  • 2026-02-25: disclosed

References

Related threats