An authenticated user can store a malicious expression in the resource‑locator field of a node. When another authenticated user opens that node in the editor, the stored value is inserted into the node’s URL template and evaluated as JavaScript in the victim’s browser, allowing the attacker to run arbitrary code within the victim’s authenticated session. The flaw is a classic expression injection (CWE‑94) with no validation of the stored value before its inclusion in a URL template. The attack requires only the ability to create or edit a node to insert the malicious value; after that any user who opens the node can be impacted. Because the injected code runs with the privileges of the victim, an attacker can compromise session integrity, exfiltrate data, or perform further actions on behalf of the victim, representing a high‑impact, cross‑user privilege escalation within the application.

The vulnerability affects the n8n workflow automation platform from n8n‑io, specifically all releases prior to 1.123.69, 2.33.4, and 2.34.1. Users running any of these unpatched versions are susceptible.

With a CVSS score of 8.4, the vulnerability is considered high severity. The EPSS score is not available, indicating no quantified exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The exploitation path requires an authenticated user to first inject the expression, after which any other authenticated user who opens the node will have the code executed in their browser. Given the ease of the initial injection and the broad impact on all other users, the practical risk remains significant.