Exploit-CVE-2025-68613

Exploit-CVE-2025-68613 Security Advisory: Vulnerabilità critica di esecuzione remota di codice in n8n CVE-2025-68613 È stata identificata una vulnerabilità critica nello strumento di automazione dei flussi di lavoro n8n che consente l'esecuzione arbitraria di codice. Gli utenti autenticati con...

CVE-2025-68613-Python-Exploit

CVE-2025-68613: n8n वर्कफ़्लो एक्सप्रेशन RCE n8n वर्कफ़्लो ऑटोमेशन प्लेटफ़ॉर्म में एक गंभीर दूरस्थ कोड निष्पादन Remote Code Execution भेद्यता के लिए प्रूफ़ ऑफ़ कॉन्सेप्ट PoC शोषण। विवरण यह भेद्यता n8n एक्सप्रेशन मूल्यांकन प्रणाली में मौजूद है। उपयोगकर्ता द्वारा प्रदान किए गए एक्सप्रेशन ठीक से...

CVE-2026-65591

CVE-2026-65591 Название уязвимого программного обеспечения и затронутые версии n8n версии до 1.123.64 n8n версии до 2.29.8 n8n версии до 2.30.1 Описание В обработчике вычисляемых членов устаревшего вычислителя выражений существует обход санитайзера. Аутентифицированный пользователь с правами на...

safe-expr-eval

safe-expr-eval Valutatore di espressioni veloce e leggero per JavaScript e TypeScript. Un parser di espressioni moderno con un'API familiare, zero dipendenze e pieno supporto TypeScript. Funzionalità Parsing e valutazione rapidi delle espressioni Leggero e senza dipendenze Supporto completo per...

NPM: n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution

NPM: n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...

GHSA-M7JC-P4HF-XHWQ Duplicate Advisory: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pm35-fqvh-cq5g. This link is maintained to preserve external references. Original Description n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An...

EUVD-2026-47635

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legac...

CVE-2026-65591

n8n before 1.123.64 is affected by a sanitizer bypass in the legacy expression evaluator’s computed-member handler. An authenticated user with workflow create/modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution in the n8n process. The ...

CVE-2026-65591 n8n before 1.123.64 Sanitizer Bypass Remote Code Execution

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legac...

PT-2026-63349

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legac...

CVE-2026-12866

A flaw was found in expr-eval. A remote attacker can exploit this vulnerability by supplying crafted expressions to the toJSFunction API. These expressions are then compiled into native code using new Function, allowing the attacker to execute arbitrary JavaScript code. This can lead to arbitrary...

simpleeval 安全漏洞

SimpleEval is a Python expression security evaluation library developed by Daniel. Versions of SimpleEval prior to 1.0.5 contained security vulnerabilities. These vulnerabilities stemmed from the possibility of objects directly accessing dangerous modules within the sandbox through attributes. If...

Prototype Pollution

expr-eval and expr-eval-fork is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of JavaScript prototype-based inheritance in the eval interface, which allows an attacker with access to manipulate object prototypes and potentially achieve arbitrary code execution...

CVE-1999-0455

The Expression Evaluator sample application in ColdFusion allows remote attackers to read or delete files on the server via exprcalc.cfm, which does not restrict access to the server properly...

CVE-2025-13204

npm package expr-eval is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue...

EUVD-2025-197614

npm package expr-eval is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue...

JavaScript Expression Evaluator 安全漏洞

JavaScript Expression Evaluator is a math calculator by Matthew Crumley Personal Developer. A security vulnerability exists in JavaScript Expression Evaluator that stems from prototype contamination and could lead to the execution of arbitrary code...

Prototype Pollution

Overview expr-eval is a Mathematical expression evaluator Affected versions of this package are vulnerable to Prototype Pollution via unrestricted member access IMEMBER and user-defined functions IFUNDEF in the expression evaluator. An attacker can execute arbitrary JavaScript code by providing...

Prototype Pollution

Overview org.webjars.npm:expr-eval is a WebJar for expr-eval Affected versions of this package are vulnerable to Prototype Pollution via unrestricted member access IMEMBER and user-defined functions IFUNDEF in the expression evaluator. An attacker can execute arbitrary JavaScript code by providin...

JavaScript Expression Evaluator 安全漏洞

JavaScript Expression Evaluator is a math calculator by Matthew Crumley Personal Developer. A security vulnerability exists in JavaScript Expression Evaluator that stems from insufficient input validation and could lead to the execution of arbitrary code...