n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution
n8n
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-65591
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- July 22, 2026
- Source last modified
- October 24, 2026
Description
n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legacy expression engine is the default in affected versions. Fixed in n8n 1.123.64, 2.29.8, and 2.30.1.
Description quoted from the NVD record.
Who is affected
n8n is a tool for automating work by linking apps and services together into step-by-step workflows. This flaw is in the older, built-in engine that works out formulas (called expressions) inside workflows, which is the default engine in affected versions. A person who can log in to n8n and has permission to create or change workflows could write a specially crafted expression that slips past a safety check and runs their own commands on the computer or server where n8n runs, with the same access n8n has. This flaw is rated High.
What to do
- Find out who looks after n8n for your organization: the person who installed or runs it, or an IT provider or vendor who manages it for you.
- If someone on your team runs n8n, that person should update it to a fixed release. This flaw is fixed in n8n
1.123.64,2.29.8and2.30.1. - If an IT provider or vendor runs n8n for you, send them this advisory and ask when the update will be done.
- For more detail on the fixed releases, see the vendor advisory linked on this page.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.