~ / search / GHSA-pm35-fqvh-cq5g

GHSA-pm35-fqvh-cq5g

n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution

Source: GitHub Advisory Database (reviewed) High CVE-2026-65591

Packages

EcosystemPackageAffectedFixed in
npm n8n < 1.123.64 1.123.64
npm n8n >= 2.30.0, < 2.30.1 2.30.1
npm n8n >= 2.0.0-rc.0, < 2.29.8 2.29.8

Details

As written in the advisory (Markdown source, shown as plain text).

## Impact The legacy expression evaluator's computed-member sanitizer can be bypassed by an authenticated user with workflow create or modify permissions. Successful exploitation grants the attacker host-level code execution as the n8n process. The legacy expression engine is the default engine in affected versions. ## Patches The issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict n8n instance access to fully trusted users only. - Switch to the non-legacy expression engine by setting `N8N_EXPRESSION_ENGINE=vm`. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

References

External links from the advisory. They lead to third-party sites.