CVE-2026-126391

EUVD-2026-125174
n8n before 1.123.89 contains an insufficient isolation vulnerability in workflow expression evaluation that allows authenticated users to escape the sandbox. Attackers with permission to create or modify workflows can craft expressions referencing unexpected JavaScript properties to execute arbitrary code on the n8n host.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 45.31%
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-gx3v-3x3v-f8r5
https://www.vulncheck.com/advisories/n8n-before-1.123.89-rce-via-workflow-expression-evaluation-sandbox-escape