8.9

CVE-2026-65591

n8n before 1.123.64 Sanitizer Bypass Remote Code Execution

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legacy expression engine is the default in affected versions. Fixed in n8n 1.123.64, 2.29.8, and 2.30.1.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
N8n ≫ N8n SwEditioncommunity SwPlatformnode.js Version < 1.123.64
N8n ≫ N8n SwEditionenterprise SwPlatformnode.js Version < 1.123.64
N8n ≫ N8n SwEditioncommunity SwPlatformnode.js Version >= 2.0.0 < 2.29.8
N8n ≫ N8n SwEditionenterprise SwPlatformnode.js Version >= 2.0.0 < 2.29.8
N8n ≫ N8n Version2.30.0 SwEditioncommunity SwPlatformnode.js
N8n ≫ N8n Version2.30.0 SwEditionenterprise SwPlatformnode.js
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.47% 0.382
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
disclosure@vulncheck.com 8.9 0 0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

https://github.com/n8n-io/n8n/security/advisories/GHSA-pm35-fqvh-cq5g
Vendor Advisory
Mitigation
https://www.vulncheck.com/advisories/n8n-before-sanitizer-bypass-remote-code-execution
Third Party Advisory