48 matches found
CVE-2026-27577 n8n: Expression Sandbox Escape Leads to RCE
n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, additional exploits in the expression evaluation of n8n have been identified and patched following CVE-2025-68613. An authenticated user with permission to create or modify workflows could abuse...
Arbitrary Code Injection
Overview n8n-workflow is a Workflow base code of n8n Affected versions of this package are vulnerable to Arbitrary Code Injection via the expression evaluation system. An attacker can execute arbitrary system commands by crafting malicious expressions in workflow parameters. Notes: 1 This is only...
📄 n8n Workflow Automation Remote Configuration / Admin Data Extraction
This Metasploit module exploits multiple vulnerabilities in n8n workflow automation tool. It leverages a file read vulnerability to steal encryption keys and database, then uses stolen credentials to authenticate and execute arbitrary commands via the Execute Command node...
Improper Input Validation
Overview n8n-workflow is a Workflow base code of n8n Affected versions of this package are vulnerable to Improper Input Validation via the credential domain validation process. An attacker can access sensitive credentials by sending requests to unintended domains using wildcard domain patterns in...
@0xlimao/n8n-nodes-ethereum (>=1.0.0 <=1.0.1), @a700/n8n-nodes-agent700 (>=1.0.5 <=1.0.7) +813 more potentially affected by CVE-2026-25055 via n8n-workflow (>=2.0.0 <=2.3.1)
n8n-workflow NPM version =2.0.0, =1.0.0, =1.0.5, =0.0.1, =1.0.0, =0.0.1, =0.0.1, =1.0.0, =0.2.2, =0.3.6, =0.1.0, =1.0.0, =1.3.1 and more Source cves: CVE-2026-25055 Source advisory: SNYK:JS-N8NWORKFLOW-15220690...
Directory Traversal
Overview n8n-workflow is a Workflow base code of n8n Affected versions of this package are vulnerable to Directory Traversal via the SSH node when workflows process uploaded files and transfer them to remote servers without validating their metadata. An attacker can write files to unintended...
@0xlimao/n8n-nodes-ethereum (=0.1.1), @adhiraj2486/n8n-nodes-vigorus (=1.0.8) +707 more potentially affected by CVE-2026-25055 via n8n-workflow (>=1.0.0 <=1.120.4)
n8n-workflow NPM version =1.0.0, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =0.5.2, =1.0.1, =1.0.0, =0.1.1, =0.1.4 - @arwinho/n8n-nodes-oxxa =0.1.0 - @avisaapp/n8n-nodes-avisaapp =0.1.0 - @bergetai/n8n-nodes-all =1.1.0 and more Source cves: CVE-2026-25055 Source advisory: SNYK:JS-N8NWORKFLOW-15220690...
GHSA-QPQ4-PW7F-PP8W n8n Has Stored Cross-site Scripting via Markdown Rendering in Workflow UI
Impact A Cross-site Scripting XSS vulnerability existed in a markdown rendering component used in n8n's interface, including workflow sticky notes and other areas that support markdown content. An authenticated user with permission to create or modify workflows could abuse this to execute scripts...
Improper Control of Dynamically-Managed Code Resources
Overview n8n-workflow is a Workflow base code of n8n Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources via the workflow expression evaluation system. An attacker can execute arbitrary code with the privileges of the underlying process by...
@0xlimao/n8n-nodes-ethereum (>=1.0.0 <=1.0.1), @a700/n8n-nodes-agent700 (>=1.0.5 <=1.0.7) +811 more potentially affected by CVE-2025-68613 +1 more via n8n-workflow (>=2.0.0-rc.0 <=2.3.0)
n8n-workflow NPM version =2.0.0-rc.0, =1.0.0, =1.0.5, =0.0.1, =1.0.0, =0.0.1, =0.0.1, =1.0.0, =0.2.2, =0.3.6, =0.1.0, =1.0.0, =1.3.1 and more Source cves: CVE-2025-68613, CVE-2026-25049 Source advisory: SNYK:JS-N8NWORKFLOW-15219713...
CVE-2026-25054 n8n is Vulnerable to Stored Cross-Site Scripting via Markdown Rendering in Workflow UI
n8n is an open source workflow automation platform. Prior to versions 1.123.9 and 2.2.1, a Cross-Site Scripting XSS vulnerability existed in a markdown rendering component used in n8n's interface, including workflow sticky notes and other areas that support markdown content. An authenticated user...
Eval Injection
Overview n8n-workflow is a Workflow base code of n8n Affected versions of this package are vulnerable to Eval Injection during the Expression evaluation workflow. Expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not...
@0xlimao/n8n-nodes-ethereum (>=1.0.0 <=1.0.1), @a700/n8n-nodes-agent700 (>=1.0.5 <=1.0.7) +813 more potentially affected by CVE-2026-1470 via n8n-workflow (>=2.0.0-rc.0 <=2.4.2)
n8n-workflow NPM version =2.0.0-rc.0, =1.0.0, =1.0.5, =0.0.1, =1.0.0, =0.0.1, =0.0.1, =1.0.0, =0.2.2, =0.3.6, =0.1.0, =1.0.0, =1.3.1 and more Source cves: CVE-2026-1470 Source advisory: SNYK:JS-N8NWORKFLOW-15118125...
@n8n/ai-workflow-builder (=1.5.0), @n8n/api-types (=1.5.0) +10 more potentially affected by CVE-2026-1470 via n8n-workflow (=2.5.0)
n8n-workflow NPM version =2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on n8n-workflow and may be impacted: - @n8n/ai-workflow-builder =1.5.0 - @n8n/api-types =1.5.0 - @n8n/backend-common =1.5.0 - @n8n/backend-test-utils =1.5.0 - @n8n/db =1.5.0 -...
@0xlimao/n8n-nodes-ethereum (=0.1.1), @adhiraj2486/n8n-nodes-vigorus (=1.0.8) +707 more potentially affected by CVE-2026-1470 via n8n-workflow (>=1.0.0 <=1.120.6)
n8n-workflow NPM version =1.0.0, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =0.5.2, =1.0.1, =1.0.0, =0.1.1, =0.1.4 - @arwinho/n8n-nodes-oxxa =0.1.0 - @avisaapp/n8n-nodes-avisaapp =0.1.0 - @bergetai/n8n-nodes-all =1.1.0 and more Source cves: CVE-2026-1470 Source advisory: SNYK:JS-N8NWORKFLOW-15118125...
PT-2026-4918
n8n and Affected Versions n8n affected versions not specified Description n8n is affected by a critical Remote Code Execution RCE issue within its workflow Expression evaluation system. An authenticated attacker can leverage this to execute arbitrary code with the privileges of the n8n process...
CVE-2026-21894 n8n's Missing Stripe-Signature Verification Allows Unauthenticated Forged Webhooks
n8n is an open source workflow automation platform. In versions from 0.150.0 to before 2.2.2, an authentication bypass vulnerability in the Stripe Trigger node allows unauthenticated parties to trigger workflows by sending forged Stripe webhook events. The Stripe Trigger creates and stores a Stri...
Arbitrary File Upload
Overview n8n-workflow is a Workflow base code of n8n Affected versions of this package are vulnerable to Arbitrary File Upload via the Git Node. An authenticated user can achieve execution of untrusted code by uploading malicious files that are subsequently executed by the service. This can lead ...
@kimio/n8n-nodes-litellm (>=1.0.2 <=1.0.3), @klardaten/n8n-nodes-datevconnect (>=1.0.1 <=1.0.2) +29 more potentially affected by CVE-2026-21877 via n8n-workflow (>=1.0.0 <=1.118.1)
n8n-workflow NPM version =1.0.0, =1.0.2, =1.0.1, =0.13.0, =0.37.0, =0.6.0, =0.14.0, =1.7.0, =1.6.0, =1.10.0, =1.39.0, =1.1.7, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-21877 Source advisory: SNYK:JS-N8NWORKFLOW-14894273...
