CVE-2026-1470

The vulnerability (CWE-95 — Improper Neutralization of Directives in Dynamically Evaluated Code) occurs because expressions provided by users during workflow configuration are evaluated in an execution context that is insufficiently isolated from the runtime environment. An attacker with access to a user account can prepare a malicious expression that will be executed outside the intended sandbox environment. As a result, the expression gains access to the system layer and executes arbitrary code with the privileges of the n8n process.

An attacker can gain full control over the n8n instance, including access to sensitive data, modification of existing workflows, and execution of operations at the operating system level. The scope of compromise is complete — encompassing confidentiality, integrity, and availability of the system.

n8n should be updated to a version containing commit aa4d1e5825829182afa0ad5b81f602638f55fa04 or later. Details are available in the vendor's references and JFrog Research analysis: https://research.jfrog.com/vulnerabilities/n8n-expression-node-rce/. Until the patch is applied, it is recommended to restrict access to the n8n instance only to trusted users.

n8n product (N8N N8N) — specific versions indicated in vendor references (fix commit: aa4d1e5825829182afa0ad5b81f602638f55fa04 in n8n-io/n8n repository)