{"id":"GHSA-gx3v-3x3v-f8r5","kind":"vulnerability","aliases":["GHSA-gx3v-3x3v-f8r5"],"related":[],"title":"Insufficient Isolation in Workflow Expression Evaluation","description":"## Impact\r\n\r\nAn authenticated user with permission to create or modify workflows could escape the isolation applied to workflow expression evaluation and execute arbitrary code on the n8n host. \r\n\r\n## Patches\r\n\r\nThe issue has been fixed in n8n versions 1.123.89, 2.45.5, 2.46.1 and 3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\r\n\r\n## Workarounds\r\n\r\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\r\n- Restrict n8n instance access to fully trusted users only.\r\n- Remove `global:member` access from any users who are not fully trusted until the instance is patched.\r\n- Audit active workflows for expressions that reference unexpected JavaScript properties.\r\n- Use the `NODES_EXCLUDE` environment variable and instance hardening settings to limit the attack surface of the running instance.\r\n\r\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","summary":"An authenticated user who can create or modify n8n workflows can escape the sandbox used for workflow expression evaluation. That lets them execute arbitrary code on the n8n server.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"n8n","fixed":[">= 1.123.89"],"affected":"< 1.123.89","ecosystem":"npm"},{"name":"n8n","fixed":[">= 2.46.1"],"affected":"< 2.46.1","ecosystem":"npm"},{"name":"n8n","fixed":[">= 2.45.5"],"affected":"< 2.45.5","ecosystem":"npm"},{"name":"n8n","fixed":[">= 3.0.1"],"affected":"< 3.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ai-tooling","n8n","self-hosted","workflow-automation"],"not_affected_if":["managed-hosting","no-workflow-editors-untrusted"],"how_to_check":"- Check the installed n8n version with `n8n --version` or in the `n8n` npm package in `package.json`; affected versions are below `1.123.89`, `2.45.5`, `2.46.1` and `3.0.1` depending on release line.\n- Review which users hold `global:member` or workflow-edit permissions.\n- Audit workflows for expressions referencing unexpected JavaScript properties.","fix":"- n8n `1.123.89`\n- n8n `2.45.5`\n- n8n `2.46.1`\n- n8n `3.0.1`","status":"open","published_at":"2026-10-28T08:47:50+00:00","first_seen_at":"2026-11-09T22:53:25+00:00","triaged_at":"2026-11-09T22:54:14+00:00","updated_at":"2026-11-09T22:54:14+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-09T22:54:14Z","model":"claude-haiku-5-5","output":{"fix":"- n8n `1.123.89`\n- n8n `2.45.5`\n- n8n `2.46.1`\n- n8n `3.0.1`","reach":"network","title":"n8n: workflow expressions let an authenticated user run code on host","impact":"high","summary":"An authenticated user who can create or modify n8n workflows can escape the sandbox used for workflow expression evaluation. That lets them execute arbitrary code on the n8n server.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["n8n","self-hosted","workflow-automation"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Code runs on the n8n host server","analyst_note":"","how_to_check":"- Check the installed n8n version with `n8n --version` or in the `n8n` npm package in `package.json`; affected versions are below `1.123.89`, `2.45.5`, `2.46.1` and `3.0.1` depending on release line.\n- Review which users hold `global:member` or workflow-edit permissions.\n- Audit workflows for expressions referencing unexpected JavaScript properties.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["managed-hosting","no-workflow-editors-untrusted"],"who_is_affected":"Any self-hosted n8n instance where users can create or edit workflows is exposed, because the flaw is reached through workflow expressions. Instances where only fully trusted users can edit workflows carry less risk but still need the patch. Instances on n8n Cloud are patched by the vendor.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000785,"input_tokens":4926,"output_tokens":584,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'1.123.89':97C '2.45.5':98C '2.46.1':99C '3.0.1':101C '3x3v':10A,15A 'access':133C,142C 'activ':157C 'administr':123C 'ai':22B 'ai-tool':21B 'appli':75C 'arbitrari':54B,82C 'attack':179C 'audit':156C 'authent':32B,62C 'autom':30B 'code':55B,83C 'consid':125C 'could':71C 'creat':36B,67C 'environ':170C 'escap':42B,72C 'evalu':6A,49B,79C 'exclud':169C 'execut':53B,81C 'express':5A,48B,78C,160C 'f8r5':11A,16A 'fix':93C 'follow':127C 'fulli':135C,149C,189C 'ghsa':8A,13A 'ghsa-gx3v-3x3v-f8r5':7A,12A 'global':140C 'gx3v':9A,14A 'harden':174C 'host':27B,87C 'immedi':121C 'impact':60C 'instanc':132C,153C,173C,184C 'insuffici':1A 'isol':2A,74C 'issu':90C 'javascript':164C 'later':111C 'let':51B 'limit':177C 'measur':203C 'member':141C 'mitig':129C,202C 'modifi':38B,69C 'n8n':17A,18A,19A,20A,24B,39B,58B,86C,95C,131C 'node':168C 'one':106C 'patch':88C,155C 'permiss':65C 'possibl':122C 'properti':165C 'refer':162C 'remedi':113C,190C 'remov':139C 'restrict':130C 'risk':192C 'run':183C 'sandbox':44B 'self':26B 'self-host':25B 'server':59B 'set':175C 'short':200C 'short-term':199C 'surfac':180C 'temporari':128C 'term':201C 'tool':23B 'trust':136C,150C 'unexpect':163C 'upgrad':104C,118C 'use':45B,166C,197C 'user':33B,63C,102C,137C,145C 'variabl':171C 'version':96C,109C 'vulner':115C 'workaround':116C,186C 'workflow':4A,29B,40B,47B,70C,77C,158C 'workflow-autom':28B","nicknames":[],"mitigations":[],"who_affected":"Any self-hosted n8n instance where users can create or edit workflows is exposed, because the flaw is reached through workflow expressions. Instances where only fully trusted users can edit workflows carry less risk but still need the patch. Instances on n8n Cloud are patched by the vendor.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["n8n"],"ptokens":["n8n"],"labels":["aitooling","high","n8n","npm","selfhosted","workflowautomation"],"campaign_type":null,"search_a":"'3x3v':10A,15A 'evalu':6A 'express':5A 'f8r5':11A,16A 'ghsa':8A,13A 'ghsa-gx3v-3x3v-f8r5':7A,12A 'gx3v':9A,14A 'insuffici':1A 'isol':2A 'n8n':17A,18A,19A,20A 'workflow':4A","search_b":"'ai':22B 'ai-tool':21B 'arbitrari':54B 'authent':32B 'autom':30B 'code':55B 'creat':36B 'escap':42B 'evalu':49B 'execut':53B 'express':48B 'host':27B 'let':51B 'modifi':38B 'n8n':24B,39B,58B 'sandbox':44B 'self':26B 'self-host':25B 'server':59B 'tool':23B 'use':45B 'user':33B 'workflow':29B,40B,47B 'workflow-autom':28B","search_c":"'1.123.89':97C '2.45.5':98C '2.46.1':99C '3.0.1':101C 'access':133C,142C 'activ':157C 'administr':123C 'appli':75C 'arbitrari':82C 'attack':179C 'audit':156C 'authent':62C 'code':83C 'consid':125C 'could':71C 'creat':67C 'environ':170C 'escap':72C 'evalu':79C 'exclud':169C 'execut':81C 'express':78C,160C 'fix':93C 'follow':127C 'fulli':135C,149C,189C 'global':140C 'harden':174C 'host':87C 'immedi':121C 'impact':60C 'instanc':132C,153C,173C,184C 'isol':74C 'issu':90C 'javascript':164C 'later':111C 'limit':177C 'measur':203C 'member':141C 'mitig':129C,202C 'modifi':69C 'n8n':86C,95C,131C 'node':168C 'one':106C 'patch':88C,155C 'permiss':65C 'possibl':122C 'properti':165C 'refer':162C 'remedi':113C,190C 'remov':139C 'restrict':130C 'risk':192C 'run':183C 'set':175C 'short':200C 'short-term':199C 'surfac':180C 'temporari':128C 'term':201C 'trust':136C,150C 'unexpect':163C 'upgrad':104C,118C 'use':166C,197C 'user':63C,102C,137C,145C 'variabl':171C 'version':96C,109C 'vulner':115C 'workaround':116C,186C 'workflow':70C,77C,158C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T08:47:50+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-gx3v-3x3v-f8r5","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-gx3v-3x3v-f8r5","severity":"high","published_at":"2026-10-28T08:47:50+00:00","modified_at":"2026-10-28T10:19:22+00:00","first_seen_at":"2026-11-09T22:53:25+00:00","fetched_at":"2026-11-09T22:53:25+00:00","note":null}],"documents":[{"id":110626,"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-gx3v-3x3v-f8r5","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}