CVE-2026-25049: n8n Expression Escape Vulnerability Leading to RCE
Summary
CVE-2026-25049: n8n Has Expression Escape Vulnerability Leading to RCE. Affects n8n across 2 version ranges.
< 1.123.17
>= 2.0.0, < 2.5.2
Fixed in 1.123.17 or 2.5.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
n8n is an open-source workflow automation tool that allows users to connect various applications and services to automate tasks. It provides a user-friendly interface for creating workflows that can include various integrations and data manipulations. However, n8n has been found to have vulnerabilities in its expression evaluation mechanism, which can lead to serious security risks if exploited.
Vulnerability Detail
The vulnerability arises from the expression evaluation feature within n8n, where an authenticated user with permissions to create or modify workflows can craft malicious expressions. This can lead to remote code execution (RCE) on the host running n8n, allowing attackers to execute arbitrary system commands. This issue has been identified as a continuation of previously reported vulnerabilities, specifically following CVE-2025-68613.
How To Fix
Latest published version: 2.44.6 as of 22 Oct 2026
npm install n8n@2.44.6Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.123.171.123.17npm install n8n@1.123.17 -
>= 2.0.0, < 2.5.22.5.2npm install n8n@2.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, administrators can implement the following temporary mitigations: 1. Limit workflow creation and editing permissions to fully trusted users only. 2. Deploy n8n in a hardened environment with restricted operating system privileges and network access to minimize the potential impact of exploitation.
Conclusion
The expression escape vulnerability in n8n (CVE-2026-25049) poses a significant risk of remote code execution for users with workflow modification permissions. It is crucial to upgrade to the latest patched versions to mitigate this risk. Temporary workarounds can provide limited protection until an upgrade can be performed.
See every vulnerability recorded for n8n →
FAQ
CVE-2026-25049 is a critical vulnerability in n8n that allows authenticated users to execute arbitrary system commands through crafted expressions in workflows.
You can check your n8n version against the patched versions (1.123.17 or 2.5.2) to determine if your installation is vulnerable. Additionally, you can use Vulert to monitor for vulnerabilities.
If exploited, this vulnerability can lead to remote code execution on the server running n8n, potentially compromising the entire system.
Implement temporary workarounds such as limiting permissions for workflow creation and deploying n8n in a more secure environment.
You can refer to the best practices for securing n8n available in their official documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for n8n.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
