n8n contains a critical Remote Code Execution vulnerability (CWE-95) in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configuration can bypass the sandbox, allowing evaluation in a context that is not sufficiently isolated from the underlying runtime. An attacker with legitimate credentials could execute arbitrary code with the privileges of the n8n process, leading to full compromise of the instance, unauthorized access to sensitive data, modification of workflows, and execution of system-level operations.

All installations of n8n, regardless of version, that allow authenticated users to supply expressions for workflow execution are affected. No other vendor or product is listed in the affected set.

The CVSS score of 9.9 reflects a high severity with full system compromise as the impact. The EPSS score of 19 % indicates a significantly higher probability of exploitation, though the high CVSS score still warrants prompt attention. The vulnerability is not currently catalogued in the CISA KEV list, but the presence of a remote code execution flaw with authenticated access warrants prompt attention. Likely attack vectors include remote exploitation by an authenticated user, and in environments where credentials can be obtained through phishing or other means, the risk increases dramatically.