CVE-2026-25049 Scanner (Version Based)

n8n is an open source workflow automation platform used to design, execute, and manage automated workflows across applications and services. It is commonly deployed by developers, DevOps teams, and organizations to orchestrate integrations between APIs, databases, and internal systems. n8n is used both in self-hosted environments and enterprise infrastructures to automate repetitive operational tasks. The platform allows users to visually build workflows using nodes and expressions. Its flexibility makes it popular in automation-heavy environments such as CI/CD pipelines, data processing, and monitoring systems. Due to its deep integration with system resources, security of workflow execution is critical.

The detected vulnerability is a Remote Code Execution issue caused by unsafe handling of expressions within workflow parameters. Authenticated users with permission to create or modify workflows can abuse crafted expressions to bypass sandbox restrictions. This vulnerability allows attackers to escape the intended expression evaluation context. Once bypassed, the attacker can execute arbitrary system-level commands on the host running n8n. The issue is especially severe in shared environments where multiple users have workflow editing rights.

Specifically, the vulnerability resides in the expression evaluation engine used by n8n's workflow nodes. When a user defines a workflow parameter that includes an expression, the platform evaluates it in a sandboxed JavaScript environment. However, due to insufficient input validation and sandbox escape protections, an attacker can inject malicious code that references Node.js built-in modules like child_process. The attack typically targets the 'parameters' field of any node that supports expressions, such as HTTP Request, Function, or Code nodes.

If exploited, an attacker can execute arbitrary commands on the n8n server, potentially leading to full system compromise. This includes data exfiltration, lateral movement within the network, installation of backdoors, or disruption of critical automation workflows. Given the high CVSS score of 9.4, this vulnerability poses a critical risk to organizations relying on n8n for sensitive operations. Immediate remediation is strongly advised to prevent unauthorized access and control.