n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution

Impact The legacy expression evaluator's computed-member sanitizer can be bypassed by an authenticated user with workflow create or modify permissions. Successful exploitation grants the attacker host-level code execution as the n8n process. The legacy expression engine is the default engine in...

GHSA-PM35-FQVH-CQ5G n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution

Impact The legacy expression evaluator's computed-member sanitizer can be bypassed by an authenticated user with workflow create or modify permissions. Successful exploitation grants the attacker host-level code execution as the n8n process. The legacy expression engine is the default engine in...

Duplicate Advisory: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pm35-fqvh-cq5g. This link is maintained to preserve external references. Original Description n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An...

GHSA-M7JC-P4HF-XHWQ Duplicate Advisory: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pm35-fqvh-cq5g. This link is maintained to preserve external references. Original Description n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An...

CVE-2026-65591

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legac...

EUVD-2026-47635

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legac...

CVE-2026-65591 n8n before 1.123.64 Sanitizer Bypass Remote Code Execution

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legac...

CVE-2026-65591

n8n before 1.123.64 is affected by a sanitizer bypass in the legacy expression evaluator’s computed-member handler. An authenticated user with workflow create/modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution in the n8n process. The ...

CVE-2026-65591 n8n before 1.123.64 Sanitizer Bypass Remote Code Execution

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legac...

PT-2026-63349

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legac...