Skip to content
OpenAdvisories

Package · npm

n8n

156 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.7
    CVE-2026-86076 Public exploit

    n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution

    n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and did not reject reserved class member names. A class field named __sanitize could rebind t…

    n8n-io n8n n8n npm
  • High 8.9
    CVE-2026-65591 Public exploit

    n8n before 1.123.64 Sanitizer Bypass Remote Code Execution

    n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code e…

    n8n-io n8n n8n npm
  • High 8.8
    CVE-2025-62726 Public exploit

    n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook

    n8n is an open source workflow automation platform. Prior to 1.113.0, a remote code execution vulnerability exists in the Git Node component available in both Cloud and Self-Hosted versions of n8n. When a malicious actor clones a remote repository containing …

    n8n-io n8n n8n npm
  • High 7.5
    CVE-2023-27564 Public exploit

    n8n Information Disclosure vulnerability

    The n8n package 0.218.0 for Node.js allows Information Disclosure.

    n8n npm