CVE-2026-85167

n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, which build their JSON query by interpolating expression values directly into the query string before parsing. A value...

CVE-2026-85165

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression...

CVE-2026-85170 n8n before 1.123.73 Local File Read and SSRF via Gmail and Brevo nodes

n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail v1 and Brevo nodes to the mail composer without verifying it is a string. An authenticated user able to run a workflow can supply an expression that resolves to an object carrying a path or href property, causing t...

CVE-2026-85170 n8n before 1.123.73 Local File Read and SSRF via Gmail and Brevo nodes

n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail v1 and Brevo nodes to the mail composer without verifying it is a string. An authenticated user able to run a workflow can supply an expression that resolves to an object carrying a path or href property, causing t...

CVE-2026-85167 n8n before 2.36.2 Query Injection via Elasticsearch Firestore Nodes

n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, which build their JSON query by interpolating expression values directly into the query string before parsing. A value...

CVE-2026-85167 n8n before 2.36.2 Query Injection via Elasticsearch Firestore Nodes

n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, which build their JSON query by interpolating expression values directly into the query string before parsing. A value...

CVE-2026-85167 n8n before 2.36.2 Query Injection via Elasticsearch Firestore Nodes

n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, which build their JSON query by interpolating expression values directly into the query string before parsing. A value...

CVE-2026-85167

n8n versions before 2.35.4 and 2.36.x before 2.36.2 are affected by a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query nodes. The root cause is that these operations build their JSON query by interpolating expression values directly int...

CVE-2026-85165 n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression...

CVE-2026-85165

n8n versions before 2.36.2 are affected by an expression sandbox bypass. The root cause is that free identifiers appearing in spread , computed-key , switch-case , or class-extension positions resolve against process globals rather than staying within the sandbox. Authenticated users with workflo...

CVE-2026-85165 n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression...

EUVD-2026-70400

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression...

CVE-2026-85165 n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression...

PT-2026-84999

n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, which build their JSON query by interpolating expression values directly into the query string before parsing. A value...

CVE-2026-85169: Improper Control of Generation of Code

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supplied placeholder name without requiring it to be an own property and admitted reserved keys; against a primitive input value it returned a live host-prototyp...

CVE-2026-85165: Improper Neutralization of Directives in Dynamically Evaluated Code

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression...

PT-2026-85001

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.73 n8n versions prior to 2.35.4 n8n versions prior to 2.36.2 Description An expression sandbox escape exists in the $fromAI handler. The $fromAI handler resolved caller-supplied placeholder names without verifying i...

PT-2026-85212

An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond th...

CVE-2026-85062: Inefficient Regular Expression Complexity

Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and...

Linux Distros Unpatched Vulnerability : CVE-2026-84642

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The values of the mail.allowedattachmenthostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames,...