Alex Joseph
Understanding the n8n Code Execution Vulnerability
A serious security flaw has been discovered in n8n, a popular workflow automation tool. This vulnerability, identified as CVE-2026-65591, is a sanitizer bypass issue within the legacy expression evaluator. In simple terms, this means that a malicious piece of code can sneak past n8n’s security checks. An attacker, if they have certain user permissions, could use this flaw to run their own code directly on the server where n8n is running. Since the legacy expression engine was the default in affected versions, many installations could be at risk.
CVE Details
- Product: n8n
- CVE ID: CVE-2026-65591
- Published: July 22, 2026
- Severity: HIGH
- Status: Analyzed
Affected Products
This vulnerability impacts various versions of n8n, specifically:
- n8n versions earlier than 1.123.64
- n8n versions earlier than 2.29.8
- n8n version 2.30.0 (for both community and enterprise editions)
Users running these versions are strongly advised to take immediate action to protect their systems.
Current Status
The vulnerability has been thoroughly analyzed. Patches are available to address this issue, making it crucial for users to update their n8n installations to a secure version. The community is aware, and solutions are at hand.
Severity Level
CVE-2026-65591 has been assigned a HIGH severity rating with a CVSS score of 8.8. This indicates a significant risk. Successful exploitation could lead to a complete loss of confidentiality, integrity, and availability on the affected system. This means an attacker could gain full control over the n8n process, access sensitive data, modify system configurations, and disrupt services.
Possible Solutions
To mitigate the risk posed by this vulnerability, it is essential to implement the following solutions:
Patches and Updates
The most effective solution is to update your n8n installation to a patched version. The issue has been fixed in:
- n8n version 1.123.64 or later
- n8n version 2.29.8 or later
- n8n version 2.30.1 or later
Upgrading ensures that the sanitizer bypass is no longer present in your system.
Temporary Workarounds
If an immediate upgrade is not feasible, the following temporary mitigations can help reduce your exposure:
- Restrict Access: Limit access to your n8n instance to only fully trusted users. This minimizes the chance of an authenticated attacker exploiting the flaw.
- Switch Expression Engine: Change the expression engine to the non-legacy version by setting the environment variable
N8N_EXPRESSION_ENGINE=vm. This bypasses the vulnerable legacy evaluator.
Please note that these workarounds offer partial protection and should only be considered short-term measures until a full update can be applied.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-pm35-fqvh-cq5g
https://www.vulncheck.com/advisories/n8n-before-sanitizer-bypass-remote-code-execution
