PT-2026-4918 · N8N · N8N

Natan Nehorai · Published 2026-01-26 · Updated 2026-03-10 · CVE-2026-1470

Positive Technologies · (AI Summary)

CVSS v3.1

9.9

Critical

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

n8n and Affected Versions n8n (affected versions not specified)

Description n8n is affected by a critical Remote Code Execution (RCE) issue within its workflow Expression evaluation system. An authenticated attacker can leverage this to execute arbitrary code with the privileges of the n8n process. This is possible because expressions provided by authenticated users during workflow configuration are evaluated in an execution context that lacks sufficient isolation from the underlying runtime. Successful exploitation could lead to a full compromise of the affected instance, potentially granting unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. Approximately 981,000 services are estimated to be exposed yearly. The issue involves bypassing the Expression sandbox, allowing for the execution of arbitrary JavaScript code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

BDU:2026-00959

CVE-2026-1470

GHSA-5XRP-6693-JJX9

Affected Products

N8N

References · 41

• https://github.com/n8n-io/n8n/commit/aa4d1e5825829182afa0ad5b81f602638f55fa04 · Patch
• https://osv.dev/vulnerability/CVE-2026-1470 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5xrp-6693-jjx9 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00959 · Security Note
• https://research.jfrog.com/vulnerabilities/n8n-expression-node-rce · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-1470 · Security Note
• https://github.com/n8n-io/n8n · Note
• https://github.com/n8n-io/n8n/commit/25c4b9605b420a98d0185a4f01115122a5134d8f · Note
• https://github.com/n8n-io/n8n/commit/30383d86139f3279a698df8d229eadfefe8627f4 · Note
• https://twitter.com/HunterMapping/status/2016698249067798668 · Twitter Post
• https://twitter.com/CveFindCom/status/2016226192097980726 · Twitter Post
• https://twitter.com/GoPlusSecurity/status/2016814674445255032 · Twitter Post
• https://twitter.com/rxerium/status/2016507425986154510 · Twitter Post
• https://t.me/true_secator/7861 · Telegram Post
• https://twitter.com/CCBalert/status/2016510874781937839 · Twitter Post