CVE-2026-25049

n8n is an open source workflow automation platform. Prior to versions 1.123.17 and 2.5.2, an authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host running n8n. This issue h...

CVE-2026-25054

n8n is an open source workflow automation platform. Prior to versions 1.123.9 and 2.2.1, a Cross-Site Scripting XSS vulnerability existed in a markdown rendering component used in n8n's interface, including workflow sticky notes and other areas that support markdown content. An authenticated user...

CVE-2026-25056

n8n is an open source workflow automation platform. Prior to versions 1.118.0 and 2.4.0, a vulnerability in the Merge node's SQL Query mode allowed authenticated users with permission to create or modify workflows to write arbitrary files to the n8n server's filesystem potentially leading to remo...

Critical n8n Flaw CVE-2026-25049 Enables System Command Execution via Malicious Workflows

A new, critical security vulnerability has been disclosed in the n8n workflow automation platform that, if successfully exploited, could result in the execution of arbitrary system commands. The flaw, tracked as CVE-2026-25049 CVSS score: 9.4, is the result of inadequate sanitization that bypasse...

Improper Input Validation

Overview n8n-workflow is a Workflow base code of n8n Affected versions of this package are vulnerable to Improper Input Validation via the credential domain validation process. An attacker can access sensitive credentials by sending requests to unintended domains using wildcard domain patterns in...

@kimio/n8n-nodes-litellm (>=1.0.2 <=1.0.3), @klardaten/n8n-nodes-datevconnect (>=1.0.1 <=1.0.2) +29 more potentially affected by CVE-2026-25631 via n8n-workflow (>=1.0.0 <=1.117.1)

n8n-workflow NPM version =1.0.0, =1.0.2, =1.0.1, =0.13.0, =0.37.0, =0.6.0, =0.14.0, =1.7.0, =1.6.0, =1.10.0, =1.39.0, =1.1.7, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-25631 Source advisory: SNYK:JS-N8NWORKFLOW-15225355...

n8n Vulnerable to Arbitrary File Write on Remote Systems via SSH Node

Impact When workflows process uploaded files and transfer them to remote servers via the SSH node without validating their metadata the vulnerability can lead to files being written to unintended locations on those remote systems potentially leading to remote code execution on those systems. As a...

@0xlimao/n8n-nodes-ethereum (>=1.0.0 <=1.0.1), @a700/n8n-nodes-agent700 (>=1.0.5 <=1.0.7) +813 more potentially affected by CVE-2026-25055 via n8n-workflow (>=2.0.0 <=2.3.1)

n8n-workflow NPM version =2.0.0, =1.0.0, =1.0.5, =0.0.1, =1.0.0, =0.0.1, =0.0.1, =1.0.0, =0.2.2, =0.3.6, =0.1.0, =1.0.0, =1.3.1 and more Source cves: CVE-2026-25055 Source advisory: SNYK:JS-N8NWORKFLOW-15220690...

Directory Traversal

Overview n8n-workflow is a Workflow base code of n8n Affected versions of this package are vulnerable to Directory Traversal via the SSH node when workflows process uploaded files and transfer them to remote servers without validating their metadata. An attacker can write files to unintended...

@0xlimao/n8n-nodes-ethereum (=0.1.1), @adhiraj2486/n8n-nodes-vigorus (=1.0.8) +707 more potentially affected by CVE-2026-25055 via n8n-workflow (>=1.0.0 <=1.120.4)

n8n-workflow NPM version =1.0.0, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =0.5.2, =1.0.1, =1.0.0, =0.1.1, =0.1.4 - @arwinho/n8n-nodes-oxxa =0.1.0 - @avisaapp/n8n-nodes-avisaapp =0.1.0 - @bergetai/n8n-nodes-all =1.1.0 and more Source cves: CVE-2026-25055 Source advisory: SNYK:JS-N8NWORKFLOW-15220690...

n8n Has Stored Cross-site Scripting via Markdown Rendering in Workflow UI

Impact A Cross-site Scripting XSS vulnerability existed in a markdown rendering component used in n8n's interface, including workflow sticky notes and other areas that support markdown content. An authenticated user with permission to create or modify workflows could abuse this to execute scripts...

GHSA-QPQ4-PW7F-PP8W n8n Has Stored Cross-site Scripting via Markdown Rendering in Workflow UI

Impact A Cross-site Scripting XSS vulnerability existed in a markdown rendering component used in n8n's interface, including workflow sticky notes and other areas that support markdown content. An authenticated user with permission to create or modify workflows could abuse this to execute scripts...

@regis-samurai/n8n (>=0.216.1 <=0.219.1), n8n-nodes-accelo (>=0.1.0 <=0.1.9) +11 more potentially affected by CVE-2026-25053 via n8n (>=0.138.0 <=0.93.0)

n8n NPM version =0.138.0, =0.216.1, =0.1.0, =0.18.0, =0.1.0, =0.1.0, =0.2.14, =0.1.0, =0.1.0, =0.0.2, =0.0.2, =1.1.3 Source cves: CVE-2026-25053 Source advisory: OSV:GHSA-9G95-QF3F-GGRW...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview n8n-core is a Core functionality of n8n Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via improper file access controls in the workflow creation or modification process. An attacker can modify sensitive host system files, including...

GHSA-GFVG-QV54-R4PC n8n's Improper File Access Controls Allow Arbitrary File Read by Authenticated Users

Impact A vulnerability in the file access controls allows authenticated users with permission to create or modify workflows to read sensitive files from the n8n host system. This can be exploited to obtain critical configuration data and user credentials, leading to complete account takeover of a...

n8n's Improper File Access Controls Allow Arbitrary File Read by Authenticated Users

Impact A vulnerability in the file access controls allows authenticated users with permission to create or modify workflows to read sensitive files from the n8n host system. This can be exploited to obtain critical configuration data and user credentials, leading to complete account takeover of a...

Cross-site Scripting (XSS)

Overview n8n-core is a Core functionality of n8n Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper enforcement of Content Security Policy in webhook response handling. An attacker can execute unauthorized scripts with same-origin privileges by crafting...

@0xlimao/n8n-nodes-ethereum (=0.1.1), @adhiraj2486/n8n-nodes-vigorus (=1.0.8) +707 more potentially affected by CVE-2025-68613 +1 more via n8n-workflow (>=1.0.0 <=1.120.3)

n8n-workflow NPM version =1.0.0, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =0.5.2, =1.0.1, =1.0.0, =0.1.1, =0.1.4 - @arwinho/n8n-nodes-oxxa =0.1.0 - @avisaapp/n8n-nodes-avisaapp =0.1.0 - @bergetai/n8n-nodes-all =1.1.0 and more Source cves: CVE-2025-68613, CVE-2026-25049 Source advisory:...

Improper Control of Dynamically-Managed Code Resources

Overview n8n-workflow is a Workflow base code of n8n Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources via the workflow expression evaluation system. An attacker can execute arbitrary code with the privileges of the underlying process by...

n8n Has Expression Escape Vulnerability Leading to RCE

Impact Additional exploits in the expression evaluation of n8n have been identified and patched following CVE-2025-68613. An authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution on th...