PT-2026-22028 · N8N · N8N

Eilonc-Pillar · Published 2026-02-25 · Updated 2026-04-15 · CVE-2026-27493

Positive Technologies (AI Summary)

CVSS v4.0

9.5

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.10.1 n8n versions prior to 2.9.3 n8n versions prior to 1.123.22

Description A second-order expression injection issue exists in the Form nodes of this open source workflow automation platform. An unauthenticated attacker can inject and evaluate arbitrary expressions by submitting crafted form data. This occurs when a form node interpolates a value provided by an unauthenticated user and the field value begins with an = character, triggering a double-evaluation of the content. While the injection is initially limited to data within the expression context, it can escalate to remote code execution on the host if chained with an expression sandbox escape. Exploitation requires a specific workflow configuration where user input is reflected back, such as on a confirmation page.

Recommendations Upgrade to version 2.10.1 or later. Upgrade to version 2.9.3 or later. Upgrade to version 1.123.22 or later. Review the usage of form nodes manually to ensure no fields prefix user-provided values with an = character. Disable the Form node by adding n8n-nodes-base.form to the NODES EXCLUDE environment variable. Disable the Form Trigger node by adding n8n-nodes-base.formTrigger to the NODES EXCLUDE environment variable.

Exploit

Fix

RCE

Eval Injection

Code Injection

Weakness Enumeration

CWE-95

CWE-94

Related Identifiers

CVE-2026-27493

GHSA-75G8-RV7V-32F7

Affected Products

N8N

References · 35

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27493.json · Exploit
• https://github.com/n8n-io/n8n/commit/562d867483e871b0f1e31776252e23bd721df75b · Patch
• https://github.com/n8n-io/n8n/security/advisories/GHSA-75g8-rv7v-32f7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27493 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-75g8-rv7v-32f7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27493 · Security Note
• https://github.com/n8n-io/n8n · Note
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.9.3 · Note
• https://github.com/n8n-io/n8n/issues/19 · Note
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.10.1 · Note
• https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.22 · Note
• https://twitter.com/infoflowcloud/status/2027006359808434468 · Twitter Post
• https://twitter.com/NoShitOasis/status/2027132009844269403 · Twitter Post
• https://twitter.com/TweetThreatNews/status/2031792285399060732 · Twitter Post
• https://twitter.com/xfeylesof/status/2043971589025186212 · Twitter Post