CVE-2026-65591 Details
Description
n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legacy expression engine is the default in affected versions. Fixed in n8n 1.123.64, 2.29.8, and 2.30.1.
A sanitizer bypass vulnerability has been identified in n8n, specifically within the legacy expression evaluator's computed-member handler. This vulnerability allows an authenticated user with permissions to create or modify workflows to craft a malicious expression that bypasses the sanitizer, leading to host-level code execution as the n8n process. The legacy expression engine is enabled by default in the affected versions, which include n8n versions prior to 1.123.64, 2.30.1, and 2.29.8.
Users can upgrade to n8n versions 1.123.64, 2.29.8, or 2.30.1 to address this vulnerability. If an immediate upgrade is not possible, it is recommended to restrict access to the n8n instance to trusted users only and to switch to the non-legacy expression engine by setting the N8N_EXPRESSION_ENGINE environment variable to 'vm'.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/n8n-io/n8n/security/advisories/GHSA-pm35-fqvh-cq5g | [email protected] | MitigationVendor Advisory |
| https://www.vulncheck.com/advisories/n8n-before-sanitizer-bypass-remote-code-execution | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-917 | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| n8n n8n | < 1.123.64 >= 2.0.0, < 2.29.8 2.30.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 27, 2026 | Initial Analysis | [email protected] |
| Jul 22, 2026 | CVE Modified | CISA-ADP |
| Jul 22, 2026 | New CVE Received | [email protected] |