Product by N8n-io
N8n
189 known vulnerabilities in N8n (N8n-io), 1 of them actively exploited (CISA KEV).
Key figures
189
Vulnerabilities
1
Actively exploited (KEV)
0
Used by ransomware
39
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-68613 | n8n Vulnerable to Remote Code Execution via Expression Injection In CISA KEValso in 1 other product | 10.0 | |
| Critical | CVE-2026-21858 | n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling | 10.0 | |
| Critical | CVE-2026-27577 | n8n: Expression Sandbox Escape Leads to RCE | 9.9 | |
| Critical | CVE-2025-68668 | n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node | 9.9 | |
| Critical | CVE-2026-21877 | n8n is vulnerable to Remote Code Execution via Arbitrary File Write | 10.0 | |
| Critical | CVE-2026-25049 | n8n Has an Expression Escape Vulnerability Leading to RCE | 9.9 | |
| Critical | CVE-2026-21893 | n8n Vulnerable to Command Injection in Community Package Installation | 7.2 | |
| High | CVE-2026-25055 | n8n Arbitrary File Write on Remote Systems via SSH Node | 8.1 | |
| Critical | CVE-2026-27493 | n8n has Unauthenticated Expression Evaluation via Form Node | 9.0 | |
| Critical | CVE-2026-72765 | n8n before 2.32.1 Remote Code Execution via Expression Sandbox Escape | 9.9 | |
| High | CVE-2026-85169 | n8n before 1.123.73 Remote Code Execution via $fromAI Prototype Leak | 8.8 | |
| High | CVE-2026-77068 | n8n before 2.34.1 Remote Code Execution via Path Traversal | 8.8 | |
| High | CVE-2026-85168 | n8n before 1.123.73 Remote Code Execution via Git Node | 8.8 | |
| High | CVE-2026-86076 | n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution | 8.8 | |
| High | CVE-2026-72767 | n8n before 1.123.67 Remote Code Execution via Git node | 8.8 | |
| Critical | CVE-2026-33660 | n8n Has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode | 8.8 | |
| Critical | CVE-2026-85165 | n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement | 9.9 | |
| High | CVE-2026-72764 | n8n before 1.123.67 Module Cache Poisoning via Code Node | 8.8 | |
| Critical | CVE-2026-77071 | n8n before 1.123.69 PostgREST Filter Injection via Supabase | 9.8 | |
| High | CVE-2026-86083 | N8n: Code Injection | 8.8 | |
| Critical | CVE-2026-42231 | n8n: Prototype Pollution in XML Webhook Body Parser Leads to RCE | 8.8 | |
| High | CVE-2026-77084 | n8n before 1.123.69 Remote Code Execution via Git Node Configuration Values | 8.8 | |
| Critical | CVE-2026-27495 | n8n has a Sandbox Escape in its JavaScript Task Runner | 9.9 | |
| Critical | CVE-2026-27497 | n8n has Potential Remote Code Execution via Merge Node | 8.8 | |
| High | CVE-2026-86075 | n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint | 7.5 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 29sans-atrisk-mail,
- n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Processthehackernews,
- Fwd: @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 20sans-atrisk,
- Fwd: @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 19sans-atrisk,