n8n: N8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection…
n8n
- Severity
- High, CVSS 7.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
- Record
- CVE-2026-77075
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 20, 2026
- Source last modified
- September 1, 2026
Description
n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resource-locator field link preview rendering. The editor spliced the field's stored value directly into the node type's URL template without checking for expression syntax. An authenticated member can store a malicious value so that when another user opens the affected node in the editor, the injected expression is evaluated as JavaScript in the victim's authenticated session (cross-user script execution).
Description quoted from the NVD record.
Who is affected
n8n is a tool for automating tasks by connecting apps and services into workflows. This flaw affects n8n versions before 1.123.69, 2.x versions before 2.33.4, and 2.34.x versions before 2.34.1. The problem is in the workflow editor, in the link preview shown for fields that point to an item in another service. A member who can log in could save a harmful value in such a field. When another user then opens that workflow step in the editor, hidden code runs as if it were that user, using their logged-in session. This flaw is rated High.
What to do
- If your organization runs n8n on its own server, the person who installed or looks after it should check which version is in use.
- Update n8n to a fixed version:
1.123.69for the 1.x line,2.33.4for 2.x versions up to 2.33, or2.34.1for 2.34.x versions. - If an IT provider or vendor runs n8n for your organization, send them this advisory and ask when the update will be done.
- Read the vendor advisory linked on this page for any further guidance on this flaw.
Analysis written from the source record as of September 1, 2026 and reviewed before publishing.