CVE-2026-77075

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions 2.x prior to 2.33.4 n8n versions 2.34.x prior to 2.34.1

Description An expression injection issue exists in the link preview rendering of the resource-locator field. The editor directly splices the stored value of this field into the URL template of the node type without validating expression syntax. This allows an authenticated member to store a malicious value that, when viewed by another user in the editor, executes the injected expression as JavaScript within the victim's authenticated session, leading to cross-user script execution.

Recommendations Update to version 1.123.69 or later. Update to version 2.33.4 or later for the 2.x branch. Update to version 2.34.1 or later for the 2.34.x branch.