iamdremig/cve-2026-65591PoC exploit for a sanitizer bypass in n8n legacy expression evaluator leading to host-level code execution by authenticated workflow creators.
Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.64 n8n versions prior to 2.29.8 n8n versions prior to 2.30.1 Description A sanitizer bypass exists in the legacy expression evaluator's computed-member handler. An authenticated user with permissions to create or modify workflows can craft a malicious expression to bypass the sanitizer, leading to host-level code execution with the privileges of the n8n process. The legacy expression engine is the default in the affected versions. Recommendations Update to version 1.123.64 or later. Update to version 2.29.8 or later. Update to version 2.30.1 or later. Switch to the non-legacy expression engine by setting N8N EXPRESSION ENGINE=vm. Restrict instance access to fully trusted users only.
