PT-2026-63349

CVE-2026-65591

Published

2026-07-22

Updated

2026-10-06

Description by

CVSS 4.0

8.9

High

MetricsAV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.64 n8n versions prior to 2.29.8 n8n versions prior to 2.30.1

Description A sanitizer bypass exists in the legacy expression evaluator's computed-member handler. An authenticated user with permissions to create or modify workflows can craft a malicious expression to bypass the sanitizer, leading to host-level code execution with the privileges of the n8n process. The legacy expression engine is the default in the affected versions.

Recommendations Update to version 1.123.64 or later. Update to version 2.29.8 or later. Update to version 2.30.1 or later. Switch to the non-legacy expression engine by setting N8N EXPRESSION ENGINE=vm. Restrict instance access to fully trusted users only.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement (\'Expression Language Injection\')

Related identifiers

CVE-2026-65591

GHSA-M7JC-P4HF-XHWQ