Description
n8n before 1.123.89 contains an insufficient isolation vulnerability in workflow expression evaluation that allows authenticated users to escape the sandbox. Attackers with permission to create or modify workflows can craft expressions referencing unexpected JavaScript properties to execute arbitrary code on the n8n host.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| n8n-io | n8n | < 1.123.89, 2.46.0 – < 2.46.1, 2.0.0 – < 2.45.5, 3.0.0 – < 3.0.1 | 1.123.89 |
Advisories 1
- WID-SEC-2026-4192 n8n: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
References
- GitHub Security Advisory (GHSA-gx3v-3x3v-f8r5) vendor-advisory
- VulnCheck Advisory: n8n before 1.123.89 RCE via Workflow Expression Evaluation Sandbox Escape third-party-advisory