by Kastro
Paper/Archive/CVE-2026-25049

CVE-2026-25049

n8n-io n8n — n8n Has an Expression Escape Vulnerability Leading to RCE

EPSS 2%CVSS 9.9
critical.is priorityof 100
45
CVSS 9.9 (NVD)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 75.3.753 × 2015.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

n8n is an open source workflow automation platform. Prior to versions 1.123.17 and 2.5.2, an authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host running n8n. This issue has been patched in versions 1.123.17 and 2.5.2.

Affected

ProductAffectedFixed inSource
n8n< 1.123.17–CNA
n8n< 2.5.2–CNA

Scores by source

NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
GitHub_M (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/n8n-io/n8n/security/advisories/GHSA-6cqr-8cfr-67f8refgithub.com/n8n-io/n8n/commit/7860896909b3d42993a36297f053d2b0e633235drefgithub.com/n8n-io/n8n/commit/936c06cfc1ad269a89e8ef7f8ac79c104436d54b