CVE-2026-65591

highpriority · attend · 45EPSS 0.007 · 53 %ileexploit · PoCEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

0.69% (53rd) EPSS

CVSS 8.8 · high

Is it mine?

9 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · scored 2026-10-27

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legacy expression engine is the default in affected versions. Fixed in n8n 1.123.64, 2.29.8, and 2.30.1.

cvss

Technical severity, 0–10. One row per scoring source.

8.9

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.9

v4.08.9highCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:Lsecondary · ENISA EU

v4.08.9highCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · disclosure@vulncheck.com

v4.07.5highCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-917USCWE-917US

exploits (1)

Public proof-of-concept and weaponised exploit code.

IamDremig/CVE-2026-65591IamDremig/CVE-2026-65591PoC · poc_in_github

affected products (9)

Products and version ranges known to be affected.

n8n-io n8n0 → 1.123.64enisa_euvdEU
n8n-io n8n0 → 2.29.8enisa_euvdEU
n8n-io n8n0 → 2.30.1enisa_euvdEU
n8n n8n< 1.123.64nvdUScpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*
n8n n8n2.0.0 → 2.29.8nvdUScpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*
n8n n8n= 2.30.0nvdUScpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*
npm n8n< 1.123.64osvUSpkg:npm/n8n
npm n8n2.0.0-rc.0 → 2.29.8osvUSpkg:npm/n8n
npm n8n2.30.0 → 2.30.1osvUSpkg:npm/n8n

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-pm35-fqvh-cq5gn8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution2026-07-22ghsa · osvUS
## Impact The legacy expression evaluator's computed-member sanitizer can be bypassed by an authenticated user with workflow create or modify permissions. Successful exploitation grants the attacker host-level code execution as the n8n process. The legacy expression engine is the default engine in affected versions. ## Patches The issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict n8n instance access to fully trusted users only. - Switch to the non-legacy expression engine by setting `N8N_EXPRESSION_ENGINE=vm`. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

published 2026-07-22modified 2026-10-24

references (6)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan