Loading vulnerability…
Expression Escape RCE in n8n
CVE-2026-25049 is a critical remote code execution vulnerability in n8n, the open source workflow automation platform. In affected versions prior to 1.123.17 and 2.5.2, the platform’s expression evaluation and sanitization mechanisms can be bypassed by crafted expressions embedded in workflow parameters. An authenticated user with permission to create or modify workflows can escape the intended expression sandbox and reach dangerous JavaScript and Node.js execution primitives, resulting in unintended system command execution on the host running n8n. Public reporting describes the issue as a follow-on bypass of protections introduced for CVE-2025-68613, with multiple exploitation paths tied to incomplete sanitization of expression syntax and runtime behavior mismatches in the sandboxing logic.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can lead to full compromise of the n8n host and the affected n8n instance. An attacker can execute arbitrary system commands, access environment variables and application secrets, expose or decrypt stored credentials, tamper with workflows, access local files, and potentially pivot to connected internal services, cloud resources, and downstream automation targets. In multi-tenant or cloud-hosted environments, the blast radius may extend beyond a single workflow or tenant depending on deployment architecture and isolation boundaries. Confidentiality, integrity, and availability impact are all high.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict workflow creation and editing permissions to fully trusted users only. Harden the n8n deployment by running it with least-privilege operating system permissions and limiting network reachability from the host to sensitive internal services. Review existing workflows for malicious or unusual expressions, especially those exposed through public webhooks, and consider rotating credentials accessible to the platform. These measures reduce exposure but do not fully remediate the vulnerability.
Patch, then assume compromise.
Upgrade n8n to a fixed release. The vulnerability is patched in n8n 1.123.17 and 2.5.2. Systems running affected earlier versions should be updated immediately to one of these versions or a later vendor-supported release. After patching, review workflows for suspicious expressions and rotate sensitive secrets that may have been exposed through the instance, including stored credentials and encryption material where applicable.
No validated public exploits yet. Hidden: 2 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
94 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.