https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T23:44:43.495013+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-339479 EUVD-2026-339479 2026-10-05T23:44:43.579373+00:00 EUVD-2026-339479 https://cve.radiocsirt.org/vuln/fkie_cve-2026-65591 fkie_cve-2026-65591 2026-10-05T23:44:43.579441+00:00

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legacy expression engine is the default in affected versions. Fixed in n8n 1.123.64, 2.29.8, and 2.30.1.

 https://cve.radiocsirt.org/vuln/ghsa-pm35-fqvh-cq5g GHSA-pm35-fqvh-cq5g — n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution 2026-10-05T23:44:43.579492+00:00

Affected: npm: n8n

## Impact The legacy expression evaluator's computed-member sanitizer can be bypassed by an authenticated user with workflow create or modify permissions. Successful exploitation grants the attacker host-level code execution as the n8n process.

The legacy expression engine is the default engine in affected versions.

## Patches The issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict n8n instance access to fully trusted users only. - Switch to the non-legacy expression engine by setting `N8N_EXPRESSION_ENGINE=vm`.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.