What is the CVSS score of CVE-2026-27577?

CVE-2026-27577 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Node.js are affected by CVE-2026-27577?

A critical vulnerability in n8n workflow automation platform (CVSS 9.9) allows remote code execution through expression evaluation, potentially enabling attackers to compromise systems and access…. A patch is available.

How to fix or mitigate CVE-2026-27577?

Within 24 hours: Identify all n8n instances in production and development environments, verify current versions against affected versions (pre-2.10.1, pre-2.9.3, pre-1.123.22), and establish patch deployment schedule. Within 7 days: Apply available patches to all affected instances starting with production environments, with testing in staging environments first. Within 30 days: Complete patch deployment across all instances, document remediation completion, and review audit logs for signs of exploitation.

Node.js CVE-2026-27577

CRITICAL

Code Injection (CWE-94)

2026-02-25 security-advisories@github.com

GHSA-vpcf-gvg4-6qwr

RCE Code Injection Command Injection Node.js N8n

9.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Mar 04, 2026 - 14:00 nvd

Patch available

CVE Published

Feb 25, 2026 - 23:16 nvd

CRITICAL 9.9

DescriptionGitHub Advisory

n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, additional exploits in the expression evaluation of n8n have been identified and patched following CVE-2025-68613. An authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host running n8n. The issues have been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate all known vulnerabilities. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only, and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

AnalysisAI

Additional expression evaluation exploits in n8n before 2.10.1/2.9.3/1.123.22. Fourth distinct code execution path through the expression engine. Patch available.