CVE-2026-25049

Published Feb 4, 2026

Last updated 5 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-25049 is a vulnerability affecting n8n, an open-source workflow automation platform, categorized as an "Improper Control of Dynamically-Managed Code Resources" (CWE-913). This flaw stems from incomplete AST-based sandboxing and weak sandboxing of user-written server-side JavaScript expressions within workflows. An authenticated user with permissions to create or modify workflows can exploit this vulnerability by crafting malicious expressions in workflow parameters. This allows for arbitrary system command execution on the host running n8n, potentially leading to a complete compromise of the n8n instance. Such an exploit could enable an attacker to run arbitrary system commands, steal credentials and sensitive configuration files, access the filesystem and internal systems, pivot to connected cloud accounts, and hijack AI workflows. Patches for this issue are available in n8n versions 1.123.17 and 2.5.2.

Description: n8n is an open source workflow automation platform. Prior to versions 1.123.17 and 2.5.2, an authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host running n8n. This issue has been patched in versions 1.123.17 and 2.5.2.
Source: security-advisories@github.com
NVD status: Analyzed
Products: n8n

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.4
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

CVSS 3.1

Type: Primary
Base score: 9.9
Impact score: 6
Exploitability score: 3.1
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security-advisories@github.com: CWE-913

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8FB57226-E06A-4156-9A24-C320BCA37EB1",
            "versionEndExcluding": "1.123.17"
          },
          {
            "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "509670CC-912A-43CD-995A-26CDBBEF3D8F",
            "versionEndExcluding": "2.5.2",
            "versionStartIncluding": "2.0.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.