The vulnerability is a sanitizer bypass in the legacy expression evaluator's computed‑member handler within n8n. An attacker who is authenticated and possesses workflow create or modify permissions can inject a crafted expression that bypasses the sanitizer and is evaluated as code. This results in host‑level code execution as the user under which the n8n process runs, giving the attacker complete control. The weakness is classified as CWE‑917.

All n8n releases prior to 1.123.64, 2.29.8, and 2.30.1 are vulnerable. The legacy expression engine is the default in these versions. Deployments of n8n running on a server where users have the ability to create or edit workflows are susceptible.

The CVSS score of 8.9 indicates a high‑severity impact. The EPSS score of < 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker must be an authenticated user with workflow create or modify permissions; based on the required permissions, it is inferred that an attacker would likely be an insider or a compromised account. Exploitation would therefore require privileged access within the environment.