n8n contains a critical Remote Code Execution vulnerability (CWE-95) in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configuration can bypass the sandbox, allowing evaluation in a context that is not sufficiently isolated from the underlying runtime. An attacker with legitimate credentials could execute arbitrary code with the privileges of the n8n process, leading to full compromise of the instance, unauthorized access to sensitive data, modification of workflows, and execution of system‑level operations.

Any installation of n8n that permits authenticated users to supply expressions for workflow execution is affected. The Common Platform Enumeration data indicates all n8n versions, and specifically version 2.5.0, are vulnerable. No other vendor or product is listed in the affected set.

The CVSS score of 9.9 reflects a high severity with full system compromise as the impact. The EPSS score is reported as less than 1 %, indicating that while exploitation is low probability, it is still possible. The vulnerability is not currently catalogued in the CISA KEV list, but the presence of a remote code execution flaw with authenticated access warrants prompt attention. Likely attack vectors include remote exploitation by an authenticated user, and in environments where credentials can be obtained through phishing or other means, the risk increases dramatically.