PT-2026-63349 · N8N · N8N

Dremig · CVE-2026-65591 · Published 2026-07-22 · Updated 2026-07-22

Positive Technologies (AI Summary)

CVSS v4.0

8.9

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.64 n8n versions prior to 2.29.8 n8n versions prior to 2.30.1

Description A sanitizer bypass exists in the legacy expression evaluator's computed-member handler. An authenticated user with permissions to create or modify workflows can craft a malicious expression to bypass the sanitizer, leading to host-level code execution with the privileges of the n8n process. The legacy expression engine is the default in the affected versions.

Recommendations Update to version 1.123.64 or later. Update to version 2.29.8 or later. Update to version 2.30.1 or later. Switch to the non-legacy expression engine by setting N8N EXPRESSION ENGINE=vm. Restrict instance access to fully trusted users only.

Fix

Weakness Enumeration

CWE-917

Related Identifiers

CVE-2026-65591

GHSA-PM35-FQVH-CQ5G

Affected Products

N8N

References · 8

• https://github.com/n8n-io/n8n/security/advisories/GHSA-pm35-fqvh-cq5g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-65591 · Security Note
• https://osv.dev/vulnerability/GHSA-pm35-fqvh-cq5g · Vendor Advisory
• https://github.com/n8n-io/n8n · Note
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1 · Note
• https://vulncheck.com/advisories/n8n-before-sanitizer-bypass-remote-code-execution · Note
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8 · Note
• https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.64 · Note