A serious security flaw has been found in n8n, a popular open-source platform for workflow automation. This vulnerability, identified as CVE-2026-86083, could allow an attacker to run malicious code on affected systems. It’s crucial for users to understand this risk and take immediate action.<\/p>\n
The issue stems from n8n’s older expression engine, specifically how it handles certain operations like calling The affected parts of the code generation are primarily in Product:<\/strong> n8n<\/p>\n Published Date:<\/strong> September 8, 2026<\/p>\n Last Modified:<\/strong> September 11, 2026<\/p>\n Severity:<\/strong> HIGH<\/p>\n Status:<\/strong> Analyzed<\/p>\n This vulnerability impacts n8n versions prior to:<\/p>\n The vulnerability has been thoroughly analyzed. The good news is that fixes are already available. Users should prioritize updating their n8n installations to mitigate the risk.<\/p>\n Rated as HIGH with a CVSS score of 8.8, this vulnerability poses a significant risk. A high severity rating indicates that exploiting this flaw could lead to critical consequences, such as unauthorized code execution, complete system compromise, or sensitive data breaches.<\/p>\n The primary solution is to update your n8n installation immediately. The developers have released patches that address this vulnerability. Please update to one of the following versions or newer:<\/p>\n If you are using an older version, make sure to check their official release notes and follow the recommended upgrade path. For those who might not be able to upgrade immediately, note that the vulnerability does not affect the newer “vm expression engine”. If your workflow can switch to this engine, it might offer some interim protection, but updating remains the most complete and recommended fix.<\/p>\n https:\/\/github.com\/n8n-io\/n8n\/releases\/tag\/n8n@1.123.76<\/p>\n https:\/\/github.com\/n8n-io\/n8n\/releases\/tag\/n8n@2.37.7<\/p>\n https:\/\/github.com\/n8n-io\/n8n\/releases\/tag\/n8n@2.38.2<\/p>\n https:\/\/github.com\/n8n-io\/n8n\/security\/advisories\/GHSA-6xcw-7xm6-48c6<\/p>\n","protected":false},"excerpt":{"rendered":" A serious security flaw has been found in n8n, a popular open-source platform for workflow automation. This vulnerability, identified as CVE-2026-86083, could allow an attacker to run malicious code on affected systems. It’s crucial for users to understand this risk and take immediate action. The issue stems from n8n’s older expression engine, specifically how it […]<\/p>\n","protected":false},"author":17,"featured_media":3515,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[899,1067,765,1244,1068],"class_list":["post-3991","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-code-execution","tag-n8n","tag-security-update","tag-vulnerability-fix","tag-workflow-automation"],"blocksy_meta":[],"yoast_head":"\nJSON.stringify<\/code> while creating source code. An attacker could trick the system into replacing JSON.stringify<\/code> with their own code. This manipulated code would then become part of the system’s executable processes, potentially leading to unauthorized control.<\/p>\npackages\/@n8n\/expression-runtime\/src\/bridge\/isolated-vm-bridge.ts<\/code> and packages\/@n8n\/tournament\/src\/ExpressionBuilder.ts<\/code>. Importantly, the newer VM expression engine is not impacted by this particular vulnerability.<\/p>\nCVE Details<\/h2>\n
Affected Products<\/h2>\n
\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
\n
References<\/h2>\n