EUVD-2026-74273
GHSA-6xcw-7xm6-48c6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects AT:P (legacy engine must be active); PR:L for authenticated user; S:U per SC:N/SI:N/SA:N in provided CVSS 4.0.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
5DescriptionCVE.org
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the legacy expression engine generated source text by calling the mutable global JSON.stringify while printing synthetic string literals and interpolating timezone data. An expression could replace JSON.stringify and cause later generated source to contain executable attacker-controlled code. The affected code-generation paths include packages/@n8n/expression-runtime/src/bridge/isolated-vm-bridge.ts and packages/@n8n/tournament/src/ExpressionBuilder.ts, and the issue does not affect the vm expression engine. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
AnalysisAI
Code injection in n8n's legacy expression engine allows an authenticated user to replace the mutable global JSON.stringify function within expression evaluation, causing subsequent code-generation paths to embed and execute attacker-controlled JavaScript. Affected are all n8n versions prior to 1.123.76 (v1 branch), 2.37.7, and 2.38.2. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) an authenticated session with sufficient privileges to create or edit workflow expressions (PR:L - low-privilege user is sufficient, not anonymous access); (2) the n8n instance must be using the legacy expression engine - the vm expression engine is explicitly documented as unaffected, meaning instances configured or migrated to use vm are not at risk; (3) the attacker's expression must be evaluated through the code-generation paths in isolated-vm-bridge.ts or ExpressionBuilder.ts. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score is 7.7, driven by AV:N/PR:L and high VC/VI/VA impact, but tempered by AT:P (attack requirements present) and PR:L (authenticated user required). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade n8n to version 1.123.76 (v1 branch), 2.37.7, or 2.38.2 (v2 branch) as documented in the GitHub security advisory GHSA-6xcw-7xm6-48c6 and the corresponding release tags at https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7 and https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all n8n instances and document versions of those running v1 prior to 1.123.76, v2 prior to 2.37.7, or v2 prior to 2.38.2. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenti
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function w
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
n8n workflow automation platform Community Edition contains an authorization bypass vulnerability allowing authenticated
The n8n package 0.218.0 for Node.js allows Information Disclosure. Rated high severity (CVSS 7.5), this vulnerability is
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today