Executive brief
n8n is a popular workflow automation tool used to connect different software services. A security vulnerability in its expression evaluator allows an authorized user with permission to create or edit workflows to bypass security filters. This could allow an attacker to execute unauthorized commands on the underlying server, potentially leading to a full system takeover and access to sensitive data handled by the automation platform.
Technical details
A vulnerability exists in n8n's legacy expression evaluator (the default engine in affected versions) due to improper neutralization of special elements in the computed-member handler (CWE-917). An authenticated attacker with workflow creation or modification privileges can craft a malicious expression that bypasses the sanitizer. Successful exploitation allows for host-level code execution as the n8n process. The issue is fixed in versions 1.123.64, 2.29.8, and 2.30.1. A temporary workaround involves switching the expression engine to 'vm' by setting the environment variable N8N_EXPRESSION_ENGINE=vm.
Affected products
- n8n-io n8n < 1.123.64, < 2.29.8, < 2.30.1
Timeline
- 2026-07-08: advisory: Original advisory GHSA-pm35-fqvh-cq5g published by n8n-io
- 2026-07-22: disclosed: CVE-2026-65591 published to NVD
- 2026-07-22: other: Duplicate advisory GHSA-m7jc-p4hf-xhwq published and withdrawn