{"id":"CVE-2026-126391","kind":"vulnerability","aliases":["CVE-2026-126391"],"related":[],"title":"n8n: workflow expressions escape sandbox and run code on host","description":"n8n before 1.123.89 contains an insufficient isolation vulnerability in workflow expression evaluation that allows authenticated users to escape the sandbox. Attackers with permission to create or modify workflows can craft expressions referencing unexpected JavaScript properties to execute arbitrary code on the n8n host.","summary":"n8n before 1.123.89 lets authenticated users escape the workflow expression sandbox through crafted JavaScript property references. An attacker who can create or modify workflows can execute arbitrary code on the n8n host.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","n8n","self-hosted","workflow-automation"],"not_affected_if":["managed-hosting","workflow-editing-restricted"],"how_to_check":"- Check the running n8n version with `n8n --version` or the n8n instance settings page.\n- Confirm whether untrusted users can create or edit workflows on the instance.","fix":"- n8n: `1.123.89`","status":"open","published_at":"2026-11-13T10:17:42+00:00","first_seen_at":"2026-11-13T10:47:18+00:00","triaged_at":"2026-11-13T10:52:28+00:00","updated_at":"2026-11-13T10:52:28+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-13T10:52:28Z","model":"claude-haiku-5-5","output":{"fix":"- n8n: `1.123.89`","reach":"network","title":"n8n: workflow expressions escape sandbox and run code on host","impact":"high","summary":"n8n before 1.123.89 lets authenticated users escape the workflow expression sandbox through crafted JavaScript property references. An attacker who can create or modify workflows can execute arbitrary code on the n8n host.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["n8n","self-hosted","workflow-automation"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"code runs on the n8n host","analyst_note":"Confirm the fixed version and any workaround in the maintainer advisory on github.com and the VulnCheck advisory before relying on the 1.123.89 fix.","how_to_check":"- Check the running n8n version with `n8n --version` or the n8n instance settings page.\n- Confirm whether untrusted users can create or edit workflows on the instance.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["workflow-editing-restricted","managed-hosting"],"who_is_affected":"Any self-hosted n8n instance below 1.123.89 where users can create or modify workflows is exposed, since the flaw is in expression evaluation inside workflows. Instances where only fully trusted administrators can edit workflows face less risk. unknown whether managed n8n cloud is patched by the vendor.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00073,"input_tokens":4600,"output_tokens":540,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126391':13A,16A '-2026':12A,15A '1.123.89':29B,61C 'ai':18B 'ai-tool':17B 'allow':72C 'arbitrari':53B,96C 'attack':44B,79C 'authent':31B,73C 'autom':26B 'code':8A,54B,97C 'contain':62C 'craft':39B,88C 'creat':47B,83C 'cve':11A,14A 'escap':4A,33B,76C 'evalu':70C 'execut':52B,95C 'express':3A,36B,69C,89C 'host':10A,23B,58B,101C 'insuffici':64C 'isol':65C 'javascript':40B,92C 'let':30B 'modifi':49B,85C 'n8n':1A,20B,27B,57B,59C,100C 'permiss':81C 'properti':41B,93C 'refer':42B 'referenc':90C 'run':7A 'sandbox':5A,37B,78C 'self':22B 'self-host':21B 'tool':19B 'unexpect':91C 'user':32B,74C 'vulner':66C 'workflow':2A,25B,35B,50B,68C,86C 'workflow-autom':24B","nicknames":[],"mitigations":[],"who_affected":"Any self-hosted n8n instance below 1.123.89 where users can create or modify workflows is exposed, since the flaw is in expression evaluation inside workflows. Instances where only fully trusted administrators can edit workflows face less risk. unknown whether managed n8n cloud is patched by the vendor.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","high","n8n","selfhosted","workflowautomation"],"campaign_type":null,"search_a":"'-126391':13A,16A '-2026':12A,15A 'code':8A 'cve':11A,14A 'escap':4A 'express':3A 'host':10A 'n8n':1A 'run':7A 'sandbox':5A 'workflow':2A","search_b":"'1.123.89':29B 'ai':18B 'ai-tool':17B 'arbitrari':53B 'attack':44B 'authent':31B 'autom':26B 'code':54B 'craft':39B 'creat':47B 'escap':33B 'execut':52B 'express':36B 'host':23B,58B 'javascript':40B 'let':30B 'modifi':49B 'n8n':20B,27B,57B 'properti':41B 'refer':42B 'sandbox':37B 'self':22B 'self-host':21B 'tool':19B 'user':32B 'workflow':25B,35B,50B 'workflow-autom':24B","search_c":"'1.123.89':61C 'allow':72C 'arbitrari':96C 'attack':79C 'authent':73C 'code':97C 'contain':62C 'craft':88C 'creat':83C 'escap':76C 'evalu':70C 'execut':95C 'express':69C,89C 'host':101C 'insuffici':64C 'isol':65C 'javascript':92C 'modifi':85C 'n8n':59C,100C 'permiss':81C 'properti':93C 'referenc':90C 'sandbox':78C 'unexpect':91C 'user':74C 'vulner':66C 'workflow':68C,86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T08:47:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126391","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126391","severity":null,"published_at":"2026-11-13T10:17:42+00:00","modified_at":"2026-11-13T10:17:42+00:00","first_seen_at":"2026-11-13T10:47:18+00:00","fetched_at":"2026-11-13T10:47:18+00:00","note":null}],"documents":[{"id":110626,"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-gx3v-3x3v-f8r5","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-10-28T08:47:50+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145025,"url":"https://www.vulncheck.com/advisories/n8n-before-1.123.89-rce-via-workflow-expression-evaluation-sandbox-escape","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}