CVE-2026-77075: n8n before 1.123.69 Expression Injection via Resource Locator
n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resource-locator field link preview rendering. The editor spliced the field's stored value directly into the node type's URL template without checking for expression syntax. An authenticated member can store a malicious value so that when another user opens the affected node in the editor, the injected expression is evaluated as JavaScript in the victim's authenticated session (cross-user script execution).
Affected Software
Event History
Frequently Asked Questions
Which users are exposed to exploitation?
An authenticated member can plant the malicious stored value, but execution occurs in the authenticated session of another user who opens the affected node in the editor. This is therefore a cross-user issue in environments where members can edit relevant resource-locator fields and other users review those nodes.
What action triggers the injected code?
The malicious expression is evaluated when a victim opens the affected node in the editor and its resource-locator field link preview is rendered. The attacker must first be able to store a malicious value in that field.
Which versions should be upgraded?
Upgrade 1.x installations to 1.123.69 or later, 2.x installations before 2.33.4 to 2.33.4 or later, and 2.34.x installations before 2.34.1 to 2.34.1 or later. The affected ranges are versions before those releases.