Expression sandbox escape leading to RCE in n8n (CVE-2026-27577)

An expression sandbox escape vulnerability in n8n's workflow automation platform allows an authenticated user with workflow creation or modification permissions to abuse crafted expressions in workflow parameters, triggering unintended system command execution on the host. This is a follow-on to CVE-2025-68613 and carries a critical severity rating, posing risk of full host compromise including confidentiality, integrity, and availability impact. Affected versions: - < 1.123.22 - >= 2.0.0 < 2.9.3 - >= 2.10.0 < 2.10.1 We recommend updating to: 1.123.22, 2.9.3, 2.10.1. CVSS 9.4 · our assessment: act_now Reference: https://github.com/n8n-io/n8n/security/advisories/GHSA-vpcf-gvg4-6qwr Details: https://vuln.today/cve/CVE-2026-27577