CVE-2026-126391: n8n before 1.123.89 RCE via Workflow Expression Evaluation Sandbox Escape
n8n before 1.123.89 contains an insufficient isolation vulnerability in workflow expression evaluation that allows authenticated users to escape the sandbox. Attackers with permission to create or modify workflows can craft expressions referencing unexpected JavaScript properties to execute arbitrary code on the n8n host.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to n8n and have permission to create or modify workflows. They can then craft workflow expressions that reference unexpected JavaScript properties to escape the expression-evaluation sandbox.
What is the impact after successful exploitation?
Successful exploitation allows arbitrary code execution on the n8n host, with high confidentiality, integrity, and availability impact.
Which versions are affected?
n8n versions before 1.123.89 are affected. Upgrading to 1.123.89 or later addresses the affected version range described here.