Executing arbitrary commands affecting n8n
A critical vulnerability affecting n8n would allow an authenticated user to execute arbitrary commands on affected systems.
Description
Technical context and vulnerability details
n8n is an open source workflow automation platform, used to orchestrate and automate business processes by connecting different services, APIs and applications. It offers features such as integrating third-party services, running custom scripts, and managing complex workflows. This platform is affected by a critical vulnerability labeled CVE-2026-25049, which constitutes a bypass of the security mechanisms introduced when fixing an earlier vulnerability (CVE-2025-68613). This vulnerability results from insufficient validation of parameters provided by an authenticated user in the workflow expression evaluation engine. Although an initial fix was made to prevent the execution of arbitrary code, some execution paths were not properly filtered, allowing an attacker with rights to create or modify workflows to inject specially crafted arguments and execute arbitrary code on affected systems. It is classified as critical with a severity score of 9.9 according to CVSS v3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Code Execution;
- Data privacy breach;
- Compromise of system integrity;
Affected systems
Products, components and targeted versions
- All versions of n8n before 1.123.17;
- All versions of n8n before 2.5.2;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update n8n to versions 1.123.17, 2.52 or the latest stable versions available;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.