Skip to content
OpenAdvisories

Vendor

n8n-io

206 known vulnerabilities.

Products

n8n 206
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.7
    CVE-2026-86076 Public exploit

    n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution

    n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and did not reject reserved class member names. A class field named __sanitize could rebind t…

    n8n-io n8n n8n npm
  • High 7.7
    CVE-2026-85168 Public exploit

    n8n before 1.123.73 Remote Code Execution via Git Node

    n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing configuration keys before each operation, but that list did not cover the content-filter and merge-d…

    n8n-io n8n
  • High 8.9
    CVE-2026-65591 Public exploit

    n8n before 1.123.64 Sanitizer Bypass Remote Code Execution

    n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code e…

    n8n-io n8n n8n npm
  • High 8.8
    CVE-2025-62726 Public exploit

    n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook

    n8n is an open source workflow automation platform. Prior to 1.113.0, a remote code execution vulnerability exists in the Git Node component available in both Cloud and Self-Hosted versions of n8n. When a malicious actor clones a remote repository containing …

    n8n-io n8n n8n npm