n8n, an open source workflow automation platform, suffered from an expression escape flaw that allows an authenticated user with workflow creation or modification rights to inject and run arbitrary system commands. The vulnerability stems from improper handling of user‑supplied expressions in workflow parameters. Exploitation grants the attacker full control over the host operating system executing the n8n instance, resulting in a complete compromise of confidentiality, integrity, and availability.

The vulnerability affects the n8n-io n8n product. Versions earlier than 1.123.17 and 2.5.2 are vulnerable; security is restored in the mentioned patch releases.

With a CVSS score of 9.4 the flaw is considered critical. The EPSS score is below 1 %, indicating a low overall exploitation probability, and the flaw is not yet listed in the CISA KEV catalog. Attackers are limited to authenticated users who can create or edit workflows, so the vulnerability is most likely to be exploited by insider threats or compromised legitimate accounts rather than by external attackers. Once authenticated, the attacker can execute any command on the host, making the risk extremely high for environments running unpatched n8n instances.