PT-2026-146677

CVE-2026-126391

·

Published

2026-11-13

·

Updated

2026-11-13

Description by

CVSS 3.1
7.5
High
MetricsAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
n8n before 1.123.89 contains an insufficient isolation vulnerability in workflow expression evaluation that allows authenticated users to escape the sandbox. Attackers with permission to create or modify workflows can craft expressions referencing unexpected JavaScript properties to execute arbitrary code on the n8n host.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-94: Improper Control of Generation of Code (\'Code Injection\')
Related identifiers
CVE-2026-126391
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com